Cybersecurity specialists report the detection of 3 vulnerabilities in various products of the technology firm Honeywell. According to the report, successful exploitation of these flaws would allow the deployment of denial of service (DoS) attacks and remote code execution.
To be precise, the vulnerabilities reside in Experion Process Knowledge System (PKS), a well known process control system. Affected versions include:
- C200: All versions
- C200E: All versions
- C300 and ACE controllers: All versions
Below is a brief description of each reported flaw, besides their tracking keys and ratings according to the Common Vulnerability Scoring System (CVSS).
CVE-2021-38397: Experio PKS is vulnerable to unrestricted file upload, which would allow threat actors to execute arbitrary code remotely and lead to a DoS attack.
The flaw received a CVSS score of 10/10, as it is considered a critical vulnerability.
CVE-2021-38395: Inadequate neutralization of special elements in the output would allow malicious hackers to execute arbitrary code remotely and cause a DoS condition.
This is a high-severity vulnerability and received a CVSS score of 9.1/10.
CVE-2021-38399: A traversal directory in the affected application would allow threat actors to access unauthorized files and directories relatively trivially.
The vulnerability received a CVSS score of 7.5/10, as it is considered a medium severity flaw.
The reports were submitted to the Cybersecurity and Infrastructure Security Agency (CISA) by researchers from the security firm Claroty.
To prevent the risk of exploitation, CISA recommends that users of affected deployments apply some of the following security measures:
- Reduce as much as possible the network exposure of potentially vulnerable devices and systems
- Identify control system networks and remote devices behind firewalls and isolate them from the enterprise network
- Using VPN tools for remote access to vulnerable systems
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
