CVE-2025-2522CWE-226

Lack of buffer clearing before reuse may result in incorrect system behavior.

Medium · published July 10, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

The Honeywell Experion PKS and OneWireless WDM

contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.

Honeywell also recommends updating to the most recent version of

Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.

The affected Experion PKS products are

C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before

520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.1th percentile
Weakness
CWE-226 · Sensitive Information in Resource Not Removed Before Reuse
Published
2025-07-10T20:11Z
EPSS history
Timeline
  • 10 JUL 20:11Z
    Lack of buffer clearing before reuse may result in incorrect system behavior.
    cvelistv5