Honeywell Experion PKS Uninitialized Variable Vulnerability in Epic Platform Analyzer Communications Leading to Denial-of-Service

A vulnerability has been identified in the Honeywell Experion PKS related to an uninitialized variable in the common Epic Platform Analyzer (EPA) communications. This issue could be exploited to manipulate communication channels, causing a dereferencing of an uninitialized pointer that leads to a denial-of-service condition. The vulnerability affects several Experion PKS products, including C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The vulnerable Experion PKS versions range from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by dereferencing an uninitialized pointer, leading to a crash or unresponsiveness in the affected component.

Remediation

Users are advised to update to the latest versions of Honeywell Experion PKS: 520.2 TCU9 HF1 and 530.1 TCU3 HF1.