Riskcovery

CVE-2025-2520

Dereferencing of an uninitialized pointer leads to denial of service.

State
Published
Severity
7.5 High
Published
Jul 10, 2025
Updated
Aug 4, 2025
Reserved
Mar 19, 2025

Read the record on cve.org

Description

The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.

Honeywell recommends updating to the most recent version of

Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are

C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHoneywell

Weaknesses

  • CWE-457 Use of Uninitialized Variable

Affected Products

ProductVersions
C300 PCNT02Honeywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
EHBHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
EHPMHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
ELMMHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
Classic ENIMHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
ETNHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
FIM4Honeywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
FIM8Honeywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
PGMHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected
RFIMHoneywell
  • 520.1 through 520.2 TCU9Affected
  • 530 through 530 TCU3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.