CVE-2025-2523

Critical

Published: 10 July 2025

Published

10 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

EPSS Score 0.0118 78.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2523 is a critical-severity Wrap or Wraparound (CWE-191) vulnerability. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely identification, reporting, and correction of software flaws like this integer underflow vulnerability via patching to recommended versions such as Experion PKS 520.2 TCU9 HF1.

SI-10 Information Input Validation good match

prevent

Mandates validation of information inputs to the Control Data Access component, preventing exploitation through malformed data causing integer underflow during subtraction operations.

SC-7 Boundary Protection good match

prevent

Enforces boundary protection to monitor and control communications at system boundaries, blocking unauthenticated remote network access required to exploit this vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote network exploitation of CDA component enabling RCE maps directly to T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction…

allowing remote code execution. Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1. The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.

Deeper analysisAI

CVE-2025-2523 is an integer underflow vulnerability (CWE-191) in the Control Data Access (CDA) component of Honeywell Experion PKS and OneWireless Wireless Device Manager (WDM). The affected Experion PKS products include C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E, with vulnerable versions spanning 520.1 through 520.2 TCU9 and 530 through 530 TCU3. For OneWireless WDM, the impacted versions are 322.1 through 322.4 and 330.1 through 330.3. The vulnerability has a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H), indicating critical severity.

A remote attacker with network access can exploit this vulnerability without authentication or user interaction due to its low attack complexity. Exploitation leads to communication channel manipulation via a failure during subtraction, potentially enabling remote code execution with low confidentiality impact but high integrity and availability impacts.

Honeywell advisories recommend updating to the latest versions: Experion PKS 520.2 TCU9 HF1 and 530.1 TCU3 HF1, or OneWireless WDM 322.5 and 331.1. Additional details are available at https://process.honeywell.com/.