--- title: "Honeywell vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/honeywell type: vendor description: "Honeywell has 133 published CVEs, 0 in CISA KEV and 11 with public exploits." updated: 2026-09-24 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Honeywell vulnerabilities - **Published CVEs:** 133 - **In CISA KEV:** 0 - **With a public exploit:** 11 - **With a patch:** 47 - **Average CVSS:** 8.0 - **CVEs in the last two years:** 17 - **First CVE:** 2007-05-31 - **Latest CVE:** 2026-09-24 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 40 | | High | 59 | | Medium | 32 | | Low | 2 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [Experion Server](https://radicalnotion.ai/vendor/honeywell/experion-server) | 17 | | [C300](https://radicalnotion.ai/vendor/honeywell/c300) | 9 | | [Saia PG5 Controls Suite](https://radicalnotion.ai/vendor/honeywell/saia-pg5-controls-suite) | 9 | | [Experion PKS](https://radicalnotion.ai/vendor/honeywell/experion-pks) | 9 | | [C200E](https://radicalnotion.ai/vendor/honeywell/c200e) | 8 | | [c300 firmware](https://radicalnotion.ai/vendor/honeywell/c300-firmware) | 7 | | [experion\_process\_knowledge\_system](https://radicalnotion.ai/vendor/honeywell/experion-process-knowledge-system) | 7 | | [C300 PCNT02](https://radicalnotion.ai/vendor/honeywell/c300-pcnt02) | 6 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-306](https://radicalnotion.ai/cwe/cwe-306) | Missing Authentication for Critical Function | 9 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 7 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 5 | | [CWE-121](https://radicalnotion.ai/cwe/cwe-121) | Stack-based Buffer Overflow | 5 | | [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 5 | | [CWE-611](https://radicalnotion.ai/cwe/cwe-611) | Improper Restriction of XML External Entity Reference | 5 | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 4 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 4 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [Honeywell](https://radicalnotion.ai/cna/honeywell) | 49 | | [icscert](https://radicalnotion.ai/cna/icscert) | 43 | | [mitre](https://radicalnotion.ai/cna/mitre) | 22 | | [zdi](https://radicalnotion.ai/cna/zdi) | 7 | | [certcc](https://radicalnotion.ai/cna/certcc) | 5 | | [Carrier](https://radicalnotion.ai/cna/carrier) | 4 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 2 | | [flexera](https://radicalnotion.ai/cna/flexera) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 10 | | 2020 | 10 | | 2021 | 4 | | 2022 | 21 | | 2023 | 17 | | 2024 | 31 | | 2025 | 9 | | 2026 | 8 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-13248 | Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface | high | 8.8 | 0.4% | No | 2026-09-24 | | CVE-2026-13249 | Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040 | critical | 9.8 | 0.9% | No | 2026-09-24 | | CVE-2026-17612 | Audit Log Exposure through Unauthorized Access | medium | 6.9 | 0.5% | No | 2026-07-27 | | CVE-2026-4272 | CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability | high | 8.1 | 0.7% | No | 2026-04-05 | | CVE-2026-3611 | Honeywell IQ4x BMS Controller Missing authentication for critical function | critical | 10.0 | 6.3% | No | 2026-03-12 | | CVE-2026-1670 | Honeywell CCTV Products Missing Authentication for Critical Function | critical | 9.3 | 0.8% | No | 2026-02-17 | | CVE-2021-47868 | WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path | high | 8.5 | 0.2% | No | 2026-01-21 | | CVE-2021-47866 | WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path | high | 8.5 | 0.2% | No | 2026-01-21 | | CVE-2025-12351 | Inadequate access control measure allows unauthorized users to access restricted administrative functions | medium | 6.8 | 0.2% | No | 2025-10-27 | | CVE-2025-3947 | Integer underflow during processing of short network packets in CDA FTEB responder | high | 8.2 | 0.4% | No | 2025-07-10 | | CVE-2025-3946 | Incorrect response generation during FTEB protocol processing | high | 8.2 | 0.6% | No | 2025-07-10 | | CVE-2025-2523 | Lack of buffer clearing before reuse may result in incorrect system behavior. | critical | 9.4 | 0.8% | No | 2025-07-10 | ## Frequently asked questions ### How many CVEs does Honeywell have? Honeywell has 133 published CVE records since 2007, including 17 in the last two years. ### How many Honeywell CVEs are in CISA KEV? None of Honeywell's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which Honeywell products have the most CVEs? The Honeywell products with the most published CVEs are Experion Server, C300, Saia PG5 Controls Suite, Experion PKS, C200E. ### What are the most common weakness types in Honeywell CVEs? Honeywell's CVEs most often map to these CWE weakness types: CWE-306 (Missing Authentication for Critical Function), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-787 (Out-of-bounds Write), CWE-121 (Stack-based Buffer Overflow). ### Are there public exploits for Honeywell vulnerabilities? Yes — 11 of Honeywell's CVEs have a known public exploit. ### How many critical Honeywell vulnerabilities are there? Honeywell has 40 critical and 59 high-severity CVEs. ### What is the average severity of Honeywell CVEs? The average CVSS base score across Honeywell's scored CVEs is 8.0. ## Related vendors - [WebKitGTK](https://radicalnotion.ai/vendor/webkitgtk) (135 CVEs) - [Motorola](https://radicalnotion.ai/vendor/motorola) (134 CVEs) - [Checkmk](https://radicalnotion.ai/vendor/checkmk) (134 CVEs) - [Codepeople](https://radicalnotion.ai/vendor/codepeople) (134 CVEs) - [ManageEngine](https://radicalnotion.ai/vendor/manageengine) (134 CVEs) - [Automattic](https://radicalnotion.ai/vendor/automattic) (133 CVEs) - [Puppet](https://radicalnotion.ai/vendor/puppet) (132 CVEs) - [RealMag777](https://radicalnotion.ai/vendor/realmag777) (132 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/honeywell). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.