Multiple flaws reported in Honeywell Experion PKS, at least one critical
Take action: If you have Honeywell Experion PKS industrial control systems, first make sure they are isolated from the internet and accessible from trusted networks. Then plan an update to R520.2 TCU9 Hot Fix 1 or R530 TCU3 Hot Fix 1 (depending on your version).
Learn More
Honeywell is reporting multiple security vulnerabilities affecting its Experion Process Knowledge System (PKS).
Honeywell Experion PKS is a distributed control system that manages complex industrial processes.
Identified Vulnerabilities:
- CVE-2025-2523 (CVSS score 9.4) - Integer Underflow vulnerability affecting Control Data Access component, enabling remote code execution through arithmetic operation failures
- CVE-2025-2521 (CVSS score 8.6) - Improper Memory Buffer Restriction affecting Control Data Access component, potentially leading to remote code execution through buffer overread conditions
- CVE-2025-3946 (CVSS score 8.2) - Deployment of Wrong Handler affecting Control Data Access component, leading to remote code execution through improper packet handling
- CVE-2025-3947 (CVSS score 8.2) - Integer Underflow vulnerability affecting Control Data Access component, causing denial of service through improper integer validation
- CVE-2025-2520 (CVSS score 7.5) - Use of Uninitialized Variable affecting Epic Platform Analyzer communications, enabling denial of service through uninitialized pointer dereferencing
- CVE-2025-2522 (CVSS score 6.5) - Sensitive Information in Resource Not Removed Before Reuse affecting Control Data Access component, causing incorrect system behavior through buffer reuse
The security vulnerabilities impact two major release branches of Honeywell Experion PKS:
- All installations running releases prior to R520.2 TCU9 Hot Fix 1
- all systems using releases prior to R530 TCU3 Hot Fix 1
Honeywell has released security updates for all identified vulnerabilities. Organizations running Experion PKS installations should upgrade to either R520.2 TCU9 Hot Fix 1 for systems running the R520 release branch or R530 TCU3 Hot Fix 1 for installations using the R530 release branch.
Organizations should also make sure all control system devices follow least-privilege access principles, minimize network exposure and isolate from the internet.
Currently, no evidence of active exploitation targeting these specific vulnerabilities has been reported to CISA.
