CVE-2025-3946

The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in incorrect handling of packets leading to remote code execution. Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1. The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.

• CWE-430

• https://process.honeywell.com/

Published

Jul 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-39454Missing Authorization vulnerability in Jeroen Peters Name Di…4.3
• CVE-2025-39455Cross-Site Request Forgery (CSRF) vulnerability in IP2Locati…7.1
• CVE-2025-39456Missing Authorization vulnerability in iTRON WP Logger wp-da…5.4
• CVE-2025-39457Missing Authorization vulnerability in magepeopleteam Bookin…5.3
• CVE-2025-39458Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-39459Incorrect Privilege Assignment vulnerability in contempoinc …7.3
• CVE-2025-39460Missing Authorization vulnerability in ThimPress Eduma eduma…5.3
• CVE-2025-39461Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-39462Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-39463Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-39464Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-39465Missing Authorization vulnerability in flippercode Advanced …4.3