Claroty’s Team82 researchers have disclosed three vulnerabilities in Honeywell’s Experion Process Knowledge System (PKS) distributed control system (DCS).
The vulnerabilities could allow an attacker to modify a Control Component Library (CCL) and load it to a controller, which would then execute malicious code. Denial-of-service attacks are also possible.
The vulnerabilities affect all versions of the C200, C200E, C300, and ACE controllers and simulators. An attacker could use the vulnerabilities to execute native code on the system, modify process values, or disrupt critical processes.
Honeywell has addressed these vulnerabilities and issued an advisory. Users are urged to update or patch affected systems as soon as possible.
ICS-CERT published an advisory today, and rated the vulnerabilities collectively, a 10.0, the highest criticality CVSS score.
