CVE-2025-3947

Integer underflow during processing of short network packets in CDA FTEB responder

State: Published
Severity: 8.2 High
Published: Jul 10, 2025
Updated: Aug 4, 2025
Reserved: Apr 25, 2025

Description

The Honeywell Experion PKS contains an Integer Underflow

vulnerability

in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to

Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of service.

Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.

The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	Honeywell

Weaknesses

CWE-191 Integer Underflow (Wrap or Wraparound)

Affected Products

Product	Versions
C300 PCNT02Honeywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
C300 PCNT05Honeywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
FIM4Honeywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
FIM8Honeywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
UOCHoneywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
CN100Honeywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
HCAHoneywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
C300PMHoneywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected
C200EHoneywell	520.1 through 520.2 TCU9Affected 530 through 530 TCU3Affected

References

https://process.honeywell.com/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.