CVE-2021-38397
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-servi...
Affects 8 products across 1 vendor.
Application allows file uploads without validating type, enabling upload of executable code or web shells.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are affected by a critical vulnerability (CVE-2021-38397) that allows unrestricted file uploads, potentially leading to remote code execution and denial-of-service conditions. The CVSS score is 10.0, indicating a severe risk. Immediate action is required to mitigate this vulnerability due to its potential impact on safety and operational continuity in industrial control systems.
BSID: BS-2022-GLOBAL-304940-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-38397?
What is the CVSS score for CVE-2021-38397?
Is CVE-2021-38397 actively exploited?
How do I remediate CVE-2021-38397?
What systems are affected by CVE-2021-38397?
What NERC-CIP standard applies to CVE-2021-38397?
What IEC 62443 requirement maps to CVE-2021-38397?
| CVE ID | CVE-2021-38397 |
|---|---|
| BSID | BS-2022-GLOBAL-304940-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2022-10-28 |
| Last Modified | 2024-11-21 |
| ICS Relevance | 85% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the file upload functionality of the Honeywell Experion PKS controllers. An attacker can exploit this vulnerability over the network without authentication, leading to the execution of arbitrary code and causing a denial-of-service condition. This could result in loss of control, data corruption, and system downtime, posing significant risks to safety and operational integrity.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Fixed Version |
|---|---|---|
| Honeywell | C200 Firmware | — |
| Honeywell | C200 | — |
| Honeywell | C200E Firmware | — |
| Honeywell | C200E | — |
| Honeywell | C300 Firmware | — |
| Honeywell | C300 | — |
| Honeywell | Application Control Environment Firmware | — |
| Honeywell | Application Control Environment | — |
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict file upload restrictions and validate all incoming files to prevent unauthorized uploads. Use network segmentation and access controls to limit exposure to untrusted networks.
This CVE violates CIP-007-R2 because it allows unauthorized access to the control system, which can lead to the execution of malicious code and compromise the security of the electronic security perimeter.
This CVE maps to SR 7.6 because it involves a vulnerability in the file upload mechanism, which can be exploited to execute arbitrary code and disrupt the operation of the control system, violating the principle of secure software development and deployment.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
SAGE Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 31ceb158e7b3d4c30917641637c97acb4b3a96397d43689c2634dcc47c8a25dc1210ea0e58bcff5d100ead0c6eacfb71ccc8dd21450ff4d4583e42b1e84b6e5c |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →