github - ghsa-3pc5-rvw8-v64m

GHSA-3PC5-RVW8-V64M

Vulnerability from github – Published: 2025-07-10 21:31 – Updated: 2025-07-10 21:31

Details

The Honeywell Experion PKS and OneWireless WDM

contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.

Honeywell also recommends updating to the most recent version of

Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.

The affected Experion PKS products are

C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before

520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2522"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-226"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-10T21:15:27Z",
    "severity": "MODERATE"
  },
  "details": "The Honeywell Experion PKS\u00a0and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\nHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u00a0\n\nThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E.  The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.",
  "id": "GHSA-3pc5-rvw8-v64m",
  "modified": "2025-07-10T21:31:54Z",
  "published": "2025-07-10T21:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2522"
    },
    {
      "type": "WEB",
      "url": "https://process.honeywell.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-2522 (GCVE-0-2025-2522)

Vulnerability from cvelistv5 – Published: 2025-07-10 20:11 – Updated: 2025-08-04 19:45

Summary

The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior. Honeywell also recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1. The affected Experion PKS products are C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before 520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

Assigner

Honeywell

References

URL

Tags

https://process.honeywell.com/

Impacted products

Vendor

Product

Version

Honeywell

C300 PCNT02

Affected: 520.1 , ≤ 520.2 TCU9 (semver)
Affected: 530 , ≤ 530 TCU3 (semver)

Honeywell	C300 PCNT05	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	FIM4	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	FIM8	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	UOC	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	CN100	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	HCA	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	C300PM	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	C200E	Affected: 520.1 , ≤ 520.2 TCU9 (semver) Affected: 530 , ≤ 530 TCU3 (semver)
Honeywell	Wireless Device Manager	Affected: 322.1 , ≤ 322.4 (semver) Affected: 330.1 , ≤ 330.3 (semver)

Credits

Demid Uzenkov and Kirill Kutaev (Positive Technologies)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-10T20:34:00.516806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-10T20:34:08.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "C300 PCNT02",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "C300 PCNT05",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "FIM4",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "FIM8",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "UOC",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "CN100",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "HCA",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "C300PM",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "C200E",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "520.2 TCU9",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "530 TCU3",
              "status": "affected",
              "version": "530",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OneWireless"
          ],
          "product": "Wireless Device Manager",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThanOrEqual": "322.4",
              "status": "affected",
              "version": "322.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "330.3",
              "status": "affected",
              "version": "330.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Honeywell Experion PKS\u0026nbsp;and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\n\u003cp\u003eHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E.  The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\u003c/p\u003e"
            }
          ],
          "value": "The Honeywell Experion PKS\u00a0and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\nHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u00a0\n\nThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E.  The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-216",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-216 Communication Channel Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-226",
              "description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T19:45:13.439Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "url": "https://process.honeywell.com/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Lack of buffer clearing before reuse may result in incorrect system behavior.",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-2522",
    "datePublished": "2025-07-10T20:11:43.603Z",
    "dateReserved": "2025-03-19T13:57:30.424Z",
    "dateUpdated": "2025-08-04T19:45:13.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3PC5-RVW8-V64M

CVE-2025-2522 (GCVE-0-2025-2522)

Tags

Sightings

Nomenclature