What is the CVSS score of CVE-2025-2520?

CVE-2025-2520 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Honeywell are affected by CVE-2025-2520?

Honeywell Experion PKS systems in your environment face a high-severity vulnerability that could enable attackers to disrupt critical process control operations through denial of service attacks.

How to fix or mitigate CVE-2025-2520?

Within 24 hours: Inventory all Experion PKS deployments to identify affected versions (520.1-520.2 TCU9 and 530-530 TCU3) and document network exposure. Within 7 days: Implement network segmentation to restrict EPA communications to trusted administrative networks and monitor for anomalous communication patterns. Within 30 days: Coordinate with Honeywell on patch availability and develop a staged deployment plan for version upgrades to 520.2 TCU9 HF1 or 530.1 TCU3 HF1, prioritizing critical production systems.

Honeywell CVE-2025-2520

EUVD-2025-21068 HIGH

Use of Uninitialized Variable (CWE-457)

2025-07-10 psirt@honeywell.com

Denial Of Service Honeywell Null Pointer Dereference

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21068

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 20:15 nvd

HIGH 7.5

DescriptionCVE.org

The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.

Honeywell recommends updating to the most recent version of

Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are

C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.

AnalysisAI

CVE-2025-2520 is an uninitialized variable vulnerability in Honeywell Experion PKS's Epic Platform Analyzer (EPA) communications module that enables remote attackers to manipulate communication channels and trigger pointer dereference errors, resulting in denial of service. The vulnerability affects multiple Experion PKS product lines across versions 520.1-520.2 TCU9 and 530-530 TCU3, with a CVSS score of 7.5 indicating high availability impact. No evidence of active exploitation (KEV status) or public POC availability is indicated; however, the network-accessible attack vector and lack of authentication requirements elevate real-world risk for critical industrial control environments.

Technical ContextAI

The vulnerability resides in the Epic Platform Analyzer (EPA) communications subsystem of Honeywell Experion PKS, a distributed process control system used in industrial automation. The root cause is classified under CWE-457 (Use of Uninitialized Variable), where the EPA communications handler fails to initialize a variable before use in the common communication protocol stack. When an attacker sends a specially crafted network packet to the EPA communications interface, the uninitialized variable is dereferenced within the channel manipulation logic, causing a null or garbage pointer dereference. This occurs in the communication channel state machine, which processes incoming requests without proper input validation or variable initialization checks. The affected products include C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM modules, all of which implement the compromised EPA protocol handler. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L) and requires no prior authentication (PR:N) or user interaction (UI:N), making it accessible to unauthenticated remote adversaries.

RemediationAI

Immediate action: upgrade to patched versions Honeywell Experion PKS 520.2 TCU9 HF1 or 530.1 TCU3 HF1 depending on your installed version. Before patching, implement network-level mitigations: (1) restrict network access to EPA communication ports using firewall rules to only trusted engineering workstations and control systems; (2) implement network segmentation to isolate Experion PKS systems from untrusted networks; (3) disable EPA communications if not in active use. Post-patch validation: test communication channel integrity after upgrade to verify EPA stability. For organizations unable to patch immediately, apply compensating controls via industrial firewalls to block unexpected EPA protocol traffic and monitor for abnormal communication patterns. Honeywell's official security advisory should be consulted for detailed patch deployment procedures and any additional workarounds specific to your configuration.