Improper input validation in Honeywell Experion PKS through 431
Priority LOW 21CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices.
Why it matters now
EPSS 0.01546 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Honeywell Experion PKS through 431 | Honeywell Experion PKS through 431 | — | No fix listed | CNA |
- Honeywell Experion PKS through 431 Vendor— Affected Honeywell Experion PKS through 431 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* | up to 311 | Vulnerable | Honeywell |
| cpe:2.3:a:honeywell:experion_process_knowledge_system:410:*:*:*:*:*:*:* | 410 | Vulnerable | Honeywell |
| cpe:2.3:a:honeywell:experion_process_knowledge_system:430:*:*:*:*:*:*:* | 430 | Vulnerable | Honeywell |
| cpe:2.3:a:honeywell:experion_process_knowledge_system:431:*:*:*:*:*:*:* | 431 | Vulnerable | Honeywell |
| cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* | up to 411 | Vulnerable | Honeywell |
- cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* Versions up to 311 Vulnerable ·Honeywell
- cpe:2.3:a:honeywell:experion_process_knowledge_system:410:*:*:*:*:*:*:* Versions 410 Vulnerable ·Honeywell
- cpe:2.3:a:honeywell:experion_process_knowledge_system:430:*:*:*:*:*:*:* Versions 430 Vulnerable ·Honeywell
- cpe:2.3:a:honeywell:experion_process_knowledge_system:431:*:*:*:*:*:*:* Versions 431 Vulnerable ·Honeywell
- cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:* Versions up to 411 Vulnerable ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8344
- 2026-10-03 Alias added: GHSA-c85h-7cv2-rr9p
References
More Honeywell Experion Process Knowledge System vulnerabilities
- TI-2014-07457 Stack-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-07455 Heap-based buffer overflow in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-07454 Improper input validation in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04434 Out-of-bounds write in Honeywell Experion PKS CVSS 3.0CRITICAL 9.8
- TI-2014-04435 Path traversal in Honeywell Experion PKS CVSS 3.0HIGH 7.5
Sources
- CVE-2016-8344 · CVE Program
- CVE-2016-8344 · NVD
- FIRST EPSS
- GHSA-c85h-7cv2-rr9p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences