CVE-2021-38397: Honeywell Application Control Environment Firmware

Critical severity, CVSS 10.0. EPSS: 1% chance of exploitation in the next 30 days.

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

Affected products

• Honeywell Application Control Environment Firmware: affected versions not specified
• Honeywell c200 Firmware: affected versions not specified
• Honeywell c200e Firmware: affected versions not specified
• Honeywell c300 Firmware: affected versions not specified

Published 2022-10-28. Last modified 2026-06-17.