CVE-2021-38395: Honeywell Application Control Environment Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

Affected products

• Honeywell Application Control Environment Firmware: affected versions not specified
• Honeywell c200 Firmware: affected versions not specified
• Honeywell c200e Firmware: affected versions not specified
• Honeywell c300 Firmware: affected versions not specified

Published 2022-10-28. Last modified 2026-06-17.