Honeywell

133 CVEs across 443 Honeywell products. Browse Honeywell vulnerabilities, severities, and proof-of-concept exploits.

Honeywell products with known CVEs

ProductCVEs
Experion Server17
C3009
Saia Pg5 Controls Suite9
C200e8
Experion Pks8
C300 Firmware7
Saia Pg5 Controls Suite7
C300 Pcnt026
Experion Process Knowledge System6
Fim46
Fim86
C300 Pcnt055
C300pm5
Cn1005
Direct Station5
Direct Station5
Engineering Station5
Engineering Station5
Experion Server5
Experion Station5
Experion Station5
Hbw2per15
Hbw2per1 Firmware5
Hca5
Hdzp252di5
Hdzp252di Firmware5
Uoc5
Xl Web Ii Controller5
Hpw2p14
Hpw2p1 Firmware4
Opc Ua Tunneller4
Safety Manager4
Safety Manager Firmware4
Wireless Device Manager4
Application Control Environment3
Application Control Environment Firmware3
C2003
C200e Firmware3
C200 Firmware3
Controledge Plc3
Controledge Plc Firmware3
Controledge Rtu3
Controledge Rtu Firmware3
H2w2gr13
H2w2gr1 Firmware3
H2w2pc1m3
H2w2pc1m Firmware3
H2w2per33
H2w2per3 Firmware3
H2w4per33
Honeywell CVEs — newest first (page 1 of 2)
CVESeverityScorePublishedSummary
CVE-2026-176122026-07-27Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability …
CVE-2026-5434Medium5.92026-05-21Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability t…
CVE-2026-5433Critical9.12026-05-21Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command …
CVE-2026-4272High8.12026-04-05Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: fro…
CVE-2026-3611Critical10.02026-03-12The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user mod…
CVE-2026-1670Critical9.82026-02-17The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery…
CVE-2021-47868High7.82026-01-21WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated…
CVE-2021-47866High7.82026-01-21WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated syst…
CVE-2025-12351Medium6.82025-10-27Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerabili…
CVE-2025-3947High8.22025-07-10The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit th…
CVE-2025-3946High8.22025-07-10The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An att…
CVE-2025-2523Critical9.42025-07-10The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker cou…
CVE-2025-2522Medium6.52025-07-10The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attac…
CVE-2025-2521High8.62025-07-10The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially…
CVE-2025-2520High7.52025-07-10The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit…
CVE-2025-2605Critical9.92025-05-02Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This is…
CVE-2023-58782025-02-06Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command inje…
CVE-2024-46453Medium6.12024-09-27A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a c…
CVE-2024-6620Low3.52024-07-29Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker could potentially inje…
CVE-2024-2422High8.82024-05-30LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows…
CVE-2024-2421Critical9.82024-05-30LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allo…
CVE-2024-2420Critical9.82024-05-30LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows…
CVE-2023-51605Medium6.52024-05-03Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s…
CVE-2023-51604Medium6.52024-05-03Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s…
CVE-2023-51603High8.82024-05-03Honeywell Saia PG5 Controls Suite CAB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu…
CVE-2023-51602Medium6.52024-05-03Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s…
CVE-2023-51601Medium6.52024-05-03Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s…
CVE-2023-51600Medium6.52024-05-03Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s…
CVE-2023-51599High8.82024-05-03Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code…
CVE-2023-5407Medium5.92024-04-17Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recom…
CVE-2023-5406Medium5.92024-04-17Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notifica…
CVE-2023-5405Medium5.92024-04-17Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Securi…
CVE-2023-5404High8.12024-04-17Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notif…
CVE-2023-5403High8.12024-04-17Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Se…
CVE-2023-5401High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker perform…
CVE-2023-5400High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performi…
CVE-2023-5398Medium5.92024-04-17Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security Notification for r…
CVE-2023-5397High8.12024-04-17Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell…
CVE-2023-5396High7.42024-04-17Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywe…
CVE-2023-5395High8.12024-04-17Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Ho…
CVE-2023-5394High7.42024-04-11Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in possible remote code e…
CVE-2023-5393High7.42024-04-11Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell…
CVE-2023-5392High7.52024-04-11C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updat…
CVE-2023-36483Medium6.52024-03-16Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android  version 1.16.18 and earlier and MASmobile Classic iOS version 1.7…
CVE-2023-1841High8.12024-02-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows X…
CVE-2024-1309Medium6.52024-02-13Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framew…
CVE-2023-5390Medium5.32024-01-31An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. T…
CVE-2023-5389Critical9.12024-01-30 An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge…
CVE-2023-6179High7.82023-11-17Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti…
CVE-2023-3712Medium6.62023-09-12Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This…
CVE-2023-3711Medium6.42023-09-12Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issu…
CVE-2023-3710Critical9.92023-09-12Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p…
CVE-2023-26597High7.52023-07-13Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recomm…
CVE-2023-25948High7.52023-07-13Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for re…
CVE-2023-25770Critical9.82023-07-13Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for…
CVE-2023-25178Critical9.82023-07-13Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading…
CVE-2023-25078Critical9.82023-07-13Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.  See H…
CVE-2023-24480Critical9.82023-07-13Controller DoS due to stack overflow when decoding a message from the server.  See Honeywell Security Notification for recommendations on upgrading and versio…
CVE-2023-24474High7.52023-07-13Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message
CVE-2023-23585Critical9.82023-07-13Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.  See Honeywell S…
CVE-2023-22435High7.52023-07-13Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.
CVE-2023-3243High8.32023-06-28 ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 ha…
CVE-2022-4240Medium6.52023-05-30Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1
CVE-2022-46361Medium6.92023-05-30An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along…
CVE-2022-43485Medium6.22023-05-30 Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue aff…
CVE-2021-38399High7.52022-10-28Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized fil…
CVE-2021-38397Critical10.02022-10-28Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbi…
CVE-2021-38395Critical9.12022-10-28Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attac…
CVE-2022-2333High8.82022-09-16If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4…
CVE-2022-2332Medium6.22022-09-16A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
CVE-2022-30312Medium6.52022-09-07The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Control…
CVE-2022-30318Critical9.82022-08-31Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. Th…
CVE-2022-30317Critical9.12022-08-31Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Cont…
CVE-2022-30320Medium4.32022-07-28Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Control…
CVE-2022-30319High8.12022-07-28Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus…
CVE-2022-30316Medium6.82022-07-28Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS S…
CVE-2022-30315Critical9.82022-07-28Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is…
CVE-2022-30314Medium4.62022-07-28Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded…
CVE-2022-30313High7.52022-07-28Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell…
CVE-2022-30245Medium6.52022-07-15Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the co…
CVE-2022-30244High8.02022-07-15Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on…
CVE-2022-30243High8.82022-07-15Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be stored on the controller…
CVE-2022-30242Medium6.82022-07-15Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration dat…
CVE-2022-1261Medium5.82022-05-26Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC se…
CVE-2021-39364High7.52022-02-24Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.
CVE-2021-39363Critical9.82022-02-24Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.
CVE-2020-27295High7.52021-01-26The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (…
CVE-2020-27299Critical9.12021-01-26The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device…
CVE-2020-27297Critical9.82021-01-26The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execut…
CVE-2020-27274High7.52021-01-26Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead t…
CVE-2020-10628High7.52020-06-26ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.
CVE-2020-10624High7.52020-06-26ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.
CVE-2020-6974Critical9.82020-04-07Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories…
CVE-2020-6982High8.82020-03-24In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
CVE-2020-6978High7.22020-03-24In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.
CVE-2020-7005High8.82020-03-24In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely…
CVE-2020-6972Critical9.12020-03-24In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web bro…
CVE-2020-6968High7.82020-02-20Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files.
CVE-2020-6960Critical9.82020-01-22The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-P…
CVE-2020-6959Critical9.82020-01-22The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-P…