CVE-2021-38395

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

• CWE-74
• CWE-74

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Mitigation, Third Party Advisory, US Government Resource
• https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdfProduct
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Mitigation, Third Party Advisory, US Government Resource
• https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdfProduct

Published

Oct 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3839A flaw was found in the vhost library in DPDK. Function vhos…7.5
• CVE-2021-38390A Blind SQL injection vulnerability exists in the /DataHandl…9.8
• CVE-2021-38391A Blind SQL injection vulnerability exists in the /DataHandl…9.8
• CVE-2021-38392A skilled attacker with physical access to the affected devi…7.6
• CVE-2021-38393A Blind SQL injection vulnerability exists in the /DataHandl…9.8
• CVE-2021-38394An attacker with physical access to the device can extract t…6.4
• CVE-2021-38396The programmer installation utility does not perform a crypt…6.8
• CVE-2021-38397Honeywell Experion PKS C200, C200E, C300, and ACE controller…10
• CVE-2021-38398The affected device uses off-the-shelf software components t…6.8
• CVE-2021-38399Honeywell Experion PKS C200, C200E, C300, and ACE controller…7.5
• CVE-2021-3840A dependency confusion vulnerability was reported in the Ant…8.8
• CVE-2021-38400An attacker with physical access to Boston Scientific Zoom L…6.8