Heap-based buffer overflow in Honeywell Experion PKS
Priority MEDIUM 48CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Why it matters now
EPSS 0.03622 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Honeywell | Experion PKS | R40x prior to R400.6; R41x prior to R410.6; R43x prior to R430.2 | — | No fix listed | CNA |
- Experion PKS VendorHoneywell Affected R40x prior to R400.6; R41x prior to R410.6; R43x prior to R430.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* | r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 | Vulnerable | Honeywell |
- cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* Versions r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 Vulnerable ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9187
- 2026-10-03 Alias added: GHSA-m8p6-m7c7-56jf
References
More Honeywell Experion Process Knowledge System vulnerabilities
- TI-2014-07457 Stack-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-07454 Improper input validation in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04434 Out-of-bounds write in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04435 Path traversal in Honeywell Experion PKS CVSS 3.0HIGH 7.5
- TI-2016-06856 Improper input validation in Honeywell Experion PKS through 431 CVSS 3.0LOW 3.7
Sources
- CVE-2014-9187 · CVE Program
- CVE-2014-9187 · NVD
- FIRST EPSS
- GHSA-m8p6-m7c7-56jf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences