CVE-2025-3947
published 2025-07-10CVE-2025-3947: The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.32%
23.2th percentile
The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of service.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| honeywell | c200e | 520.1 – 520.2 TCU9 | — |
| honeywell | c200e | 530 – 530 TCU3 | — |
| honeywell | c300_pcnt02 | 520.1 – 520.2 TCU9 | — |
| honeywell | c300_pcnt02 | 530 – 530 TCU3 | — |
| honeywell | c300_pcnt05 | 520.1 – 520.2 TCU9 | — |
| honeywell | c300_pcnt05 | 530 – 530 TCU3 | — |
| honeywell | c300pm | 520.1 – 520.2 TCU9 | — |
| honeywell | c300pm | 530 – 530 TCU3 | — |
| honeywell | cn100 | 520.1 – 520.2 TCU9 | — |
| honeywell | cn100 | 530 – 530 TCU3 | — |
| honeywell | fim4 | 520.1 – 520.2 TCU9 | — |
| honeywell | fim4 | 530 – 530 TCU3 | — |
| honeywell | fim8 | 520.1 – 520.2 TCU9 | — |
| honeywell | fim8 | 530 – 530 TCU3 | — |
| honeywell | hca | 520.1 – 520.2 TCU9 | — |
| honeywell | hca | 530 – 530 TCU3 | — |
| honeywell | uoc | 520.1 – 520.2 TCU9 | — |
| honeywell | uoc | 530 – 530 TCU3 | — |
| msrc | cbl2_qemu_6.2.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_qemu-kvm_4.2.0-38_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Honeywell Experion PKS (Update A)
cisa_ics·2025-09-04·CVSS 7.5
[HIGH] Honeywell Experion PKS (Update A)
ICS Advisory
##
Honeywell Experion PKS (Update A)
Last RevisedSeptember 04, 2025
Alert CodeICSA-25-205-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Honeywell
- Equipment: Experion PKS
- Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.
## 3. TECHNICAL
Microsoft
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious use
vendor_msrc·2022-02-08·CVSS 5.5
CVE-2021-3947 [MEDIUM] CWE-125 A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious use
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more informatio
GHSA
GHSA-96x3-56x6-r6f5: The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA)
ghsa_unreviewed·2025-07-10
CVE-2025-3947 [HIGH] CWE-191 GHSA-96x3-56x6-r6f5: The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA)
The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of service.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-10
Published