Stack-based buffer overflow in Honeywell Experion PKS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Honeywell | Experion PKS | R40x prior to R400.6; R41x prior to R410.6; R43x prior to R430.2 | — | No fix listed | CNA |
- Experion PKS VendorHoneywell Affected R40x prior to R400.6; R41x prior to R410.6; R43x prior to R430.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* | r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 | Vulnerable | Honeywell |
- cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* Versions r400 to before r400.6; r410 to before r410.6; r430 to before r430.2 Vulnerable ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9189
- 2026-10-03 Alias added: GHSA-74pv-2x2q-87g8
References
More Honeywell Experion Process Knowledge System vulnerabilities
- TI-2014-07455 Heap-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-07454 Improper input validation in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04434 Out-of-bounds write in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04435 Path traversal in Honeywell Experion PKS CVSS 3.0HIGH 7.5
- TI-2016-06856 Improper input validation in Honeywell Experion PKS through 431 CVSS 3.0LOW 3.7
Sources
- CVE-2014-9189 · CVE Program
- CVE-2014-9189 · NVD
- FIRST EPSS
- GHSA-74pv-2x2q-87g8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences