Honeywell
133 CVEs across 443 Honeywell products. Browse Honeywell vulnerabilities, severities, and proof-of-concept exploits.
Honeywell products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17612 | | 2026-07-27 | Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability … | |
CVE-2026-5434 | Medium | 5.9 | 2026-05-21 | Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability t… |
CVE-2026-5433 | Critical | 9.1 | 2026-05-21 | Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command … |
CVE-2026-4272 | High | 8.1 | 2026-04-05 | Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: fro… |
CVE-2026-3611 | Critical | 10.0 | 2026-03-12 | The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user mod… |
CVE-2026-1670 | Critical | 9.8 | 2026-02-17 | The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery… |
CVE-2021-47868 | High | 7.8 | 2026-01-21 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated… |
CVE-2021-47866 | High | 7.8 | 2026-01-21 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated syst… |
CVE-2025-12351 | Medium | 6.8 | 2025-10-27 | Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerabili… |
CVE-2025-3947 | High | 8.2 | 2025-07-10 | The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit th… |
CVE-2025-3946 | High | 8.2 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An att… |
CVE-2025-2523 | Critical | 9.4 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker cou… |
CVE-2025-2522 | Medium | 6.5 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attac… |
CVE-2025-2521 | High | 8.6 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially… |
CVE-2025-2520 | High | 7.5 | 2025-07-10 | The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit… |
CVE-2025-2605 | Critical | 9.9 | 2025-05-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This is… |
CVE-2023-5878 | | 2025-02-06 | Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command inje… | |
CVE-2024-46453 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-6620 | Low | 3.5 | 2024-07-29 | Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker could potentially inje… |
CVE-2024-2422 | High | 8.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows… |
CVE-2024-2421 | Critical | 9.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allo… |
CVE-2024-2420 | Critical | 9.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows… |
CVE-2023-51605 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51604 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51603 | High | 8.8 | 2024-05-03 | Honeywell Saia PG5 Controls Suite CAB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2023-51602 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51601 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51600 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51599 | High | 8.8 | 2024-05-03 | Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2023-5407 | Medium | 5.9 | 2024-04-17 | Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recom… |
CVE-2023-5406 | Medium | 5.9 | 2024-04-17 | Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notifica… |
CVE-2023-5405 | Medium | 5.9 | 2024-04-17 | Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Securi… |
CVE-2023-5404 | High | 8.1 | 2024-04-17 | Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notif… |
CVE-2023-5403 | High | 8.1 | 2024-04-17 | Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Se… |
CVE-2023-5401 | High | 8.1 | 2024-04-17 | Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker perform… |
CVE-2023-5400 | High | 8.1 | 2024-04-17 | Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performi… |
CVE-2023-5398 | Medium | 5.9 | 2024-04-17 | Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security Notification for r… |
CVE-2023-5397 | High | 8.1 | 2024-04-17 | Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell… |
CVE-2023-5396 | High | 7.4 | 2024-04-17 | Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywe… |
CVE-2023-5395 | High | 8.1 | 2024-04-17 | Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Ho… |
CVE-2023-5394 | High | 7.4 | 2024-04-11 | Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in possible remote code e… |
CVE-2023-5393 | High | 7.4 | 2024-04-11 | Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell… |
CVE-2023-5392 | High | 7.5 | 2024-04-11 | C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updat… |
CVE-2023-36483 | Medium | 6.5 | 2024-03-16 | Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7… |
CVE-2023-1841 | High | 8.1 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows X… |
CVE-2024-1309 | Medium | 6.5 | 2024-02-13 | Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framew… |
CVE-2023-5390 | Medium | 5.3 | 2024-01-31 | An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. T… |
CVE-2023-5389 | Critical | 9.1 | 2024-01-30 | An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge… |
CVE-2023-6179 | High | 7.8 | 2023-11-17 | Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti… |
CVE-2023-3712 | Medium | 6.6 | 2023-09-12 | Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This… |
CVE-2023-3711 | Medium | 6.4 | 2023-09-12 | Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issu… |
CVE-2023-3710 | Critical | 9.9 | 2023-09-12 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p… |
CVE-2023-26597 | High | 7.5 | 2023-07-13 | Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recomm… |
CVE-2023-25948 | High | 7.5 | 2023-07-13 | Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for re… |
CVE-2023-25770 | Critical | 9.8 | 2023-07-13 | Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for… |
CVE-2023-25178 | Critical | 9.8 | 2023-07-13 | Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading… |
CVE-2023-25078 | Critical | 9.8 | 2023-07-13 | Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See H… |
CVE-2023-24480 | Critical | 9.8 | 2023-07-13 | Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versio… |
CVE-2023-24474 | High | 7.5 | 2023-07-13 | Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message |
CVE-2023-23585 | Critical | 9.8 | 2023-07-13 | Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell S… |
CVE-2023-22435 | High | 7.5 | 2023-07-13 | Experion server may experience a DoS due to a stack overflow when handling a specially crafted message. |
CVE-2023-3243 | High | 8.3 | 2023-06-28 | ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 ha… |
CVE-2022-4240 | Medium | 6.5 | 2023-05-30 | Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1 |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2022-43485 | Medium | 6.2 | 2023-05-30 | Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue aff… |
CVE-2021-38399 | High | 7.5 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized fil… |
CVE-2021-38397 | Critical | 10.0 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbi… |
CVE-2021-38395 | Critical | 9.1 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attac… |
CVE-2022-2333 | High | 8.8 | 2022-09-16 | If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4… |
CVE-2022-2332 | Medium | 6.2 | 2022-09-16 | A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment. |
CVE-2022-30312 | Medium | 6.5 | 2022-09-07 | The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Control… |
CVE-2022-30318 | Critical | 9.8 | 2022-08-31 | Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. Th… |
CVE-2022-30317 | Critical | 9.1 | 2022-08-31 | Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Cont… |
CVE-2022-30320 | Medium | 4.3 | 2022-07-28 | Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Control… |
CVE-2022-30319 | High | 8.1 | 2022-07-28 | Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus… |
CVE-2022-30316 | Medium | 6.8 | 2022-07-28 | Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS S… |
CVE-2022-30315 | Critical | 9.8 | 2022-07-28 | Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is… |
CVE-2022-30314 | Medium | 4.6 | 2022-07-28 | Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded… |
CVE-2022-30313 | High | 7.5 | 2022-07-28 | Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell… |
CVE-2022-30245 | Medium | 6.5 | 2022-07-15 | Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the co… |
CVE-2022-30244 | High | 8.0 | 2022-07-15 | Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on… |
CVE-2022-30243 | High | 8.8 | 2022-07-15 | Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be stored on the controller… |
CVE-2022-30242 | Medium | 6.8 | 2022-07-15 | Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration dat… |
CVE-2022-1261 | Medium | 5.8 | 2022-05-26 | Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC se… |
CVE-2021-39364 | High | 7.5 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved. |
CVE-2021-39363 | Critical | 9.8 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. |
CVE-2020-27295 | High | 7.5 | 2021-01-26 | The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (… |
CVE-2020-27299 | Critical | 9.1 | 2021-01-26 | The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device… |
CVE-2020-27297 | Critical | 9.8 | 2021-01-26 | The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execut… |
CVE-2020-27274 | High | 7.5 | 2021-01-26 | Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead t… |
CVE-2020-10628 | High | 7.5 | 2020-06-26 | ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network. |
CVE-2020-10624 | High | 7.5 | 2020-06-26 | ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network. |
CVE-2020-6974 | Critical | 9.8 | 2020-04-07 | Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories… |
CVE-2020-6982 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution. |
CVE-2020-6978 | High | 7.2 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries. |
CVE-2020-7005 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely… |
CVE-2020-6972 | Critical | 9.1 | 2020-03-24 | In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web bro… |
CVE-2020-6968 | High | 7.8 | 2020-02-20 | Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files. |
CVE-2020-6960 | Critical | 9.8 | 2020-01-22 | The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-P… |
CVE-2020-6959 | Critical | 9.8 | 2020-01-22 | The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-P… |