Improper input validation in Honeywell Experion PKS
Priority MEDIUM 48CWE-98Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-98.
Summary
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Why it matters now
EPSS 0.0365 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Honeywell | Experion PKS | R40x before R400.6; R41x before R410.6; R43x before R430.2 | — | No fix listed | CNA |
- Experion PKS VendorHoneywell Affected R40x before R400.6; R41x before R410.6; R43x before R430.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* | r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 | Vulnerable | Honeywell |
- cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* Versions r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 Vulnerable ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9186
- 2026-10-03 Alias added: GHSA-7q7j-2f25-p5hw
References
More Honeywell Experion Process Knowledge System vulnerabilities
- TI-2014-07457 Stack-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-07455 Heap-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04434 Out-of-bounds write in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04435 Path traversal in Honeywell Experion PKS CVSS 3.0HIGH 7.5
- TI-2016-06856 Improper input validation in Honeywell Experion PKS through 431 CVSS 3.0LOW 3.7
Sources
- CVE-2014-9186 · CVE Program
- CVE-2014-9186 · NVD
- FIRST EPSS
- GHSA-7q7j-2f25-p5hw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences