Honeywell OneWireless WDM Vulnerabilities: Patch to R322.5 or R331.1 Now

Honeywell’s OneWireless Wireless Device Manager (WDM) has been the subject of a high-severity coordinated disclosure: multiple vulnerabilities in the Control Data Access (CDA) component allow remote attackers to cause information disclosure, denial-of-service, and, in the worst cases, remote code execution — and Honeywell, CISA, and third-party researchers are urging operators to update affected OneWireless WDM releases to R322.5 or R331.1 immediately.

Background / Overview​

The advisories identify four distinct weakness classes in OneWireless WDM’s CDA module: a memory-buffer overread, reuse of sensitive resource data, an integer underflow, and an incorrect handler deployment. Collectively these issues carry high CVSS ratings (several in the high‑8 to 9+ range by CVSS v3.1 and v4 calculations) and are scored as remotely exploitable with low attack complexity in public assessments. Honeywell’s remediation guidance points operators to fixed OneWireless WDM releases R322.5 and R331.1 (and corresponding Experion PKS releases) for definitive fixes. These findings arrived via coordinated disclosure from external researchers and were cataloged by standard vulnerability databases and CISA bulletins. The pattern — multiple, remotely exploitable flaws in an ICS/OT management component — follows a recurring theme across recent industrial disclosures: remote‑accessible protocol and memory‑handling bugs remain high‑impact vectors for attackers. Independent advisory analysis indicates that organizations running legacy or unpatched ICS stacks are at disproportionate risk.

---

What’s affected: products and versions​

• OneWireless Wireless Device Manager (WDM): all releases prior to R322.5 and prior to R331.1 are listed as affected.
• Honeywell Experion PKS: multiple Experion PKS modules and firmware ranges are also implicated in advisory texts; the practical upshot is that operators using Experion + OneWireless in the same control plane should treat both product families as in-scope when triaging exposure. (dbugs.ptsecurity.com)

Key CVE identifiers tied to the disclosure:

• CVE‑2025‑2521 — memory buffer / buffer overread (CWE‑119).
• CVE‑2025‑2522 — sensitive information in resource not removed before reuse (CWE‑226).
• CVE‑2025‑2523 — integer underflow (CWE‑191) leading to communication channel manipulation. (dbugs.ptsecurity.com)
• CVE‑2025‑3946 — deployment of wrong handler (CWE‑430) resulting in incorrect packet handling.

For operations teams, the simple inventory question is binary: if you run OneWireless WDM and are on a release earlier than R322.5 or R331.1, you are running vulnerable code and require mitigation. Vendor notices and database entries consistently point to the same corrective release versions. (cvedetails.com)

---

Vulnerability breakdown — technical summary​

1) Memory buffer overread (CWE‑119) — CVE‑2025‑2521​

This defect exists in the CDA component: insufficient bounds checking leads to buffer overread, enabling attackers to read beyond expected buffers and, in some flows, to influence control flow. Public vulnerability records show a high-severity rating (CVSS v3.1 in the high‑8s; CVSS v4 assessments likewise indicate serious risk), and vendor guidance recommends updating to R322.5 / R331.1. The practical impact can be remote code execution if the out‑of‑bounds read can be escalated to write or control‑flow manipulation.

2) Sensitive information left in resource before reuse (CWE‑226) — CVE‑2025‑2522​

A failure to clear sensitive buffers before they are reused can allow previously stored sensitive data to be exposed or incorrectly reapplied to new operations. In OneWireless’s CDA, this class of bug can be exploited via communication-channel manipulation to produce incorrect system behavior. The record shows a moderate-to-high CVSS rating; Honeywell’s fix guidance is consistent with an update requirement.

3) Integer underflow (CWE‑191) — CVE‑2025‑2523​

This is the most consequential of the set on paper: an integer subtraction underflow in CDA that can be provoked across the communication channel, producing conditions that permit remote code execution or severe logic failures. Public trackers show a CVSS v3.1 base score in the 9+ range for this issue, and multiple advisories highlight the exploitability potential in networked deployments. Honeywell and researchers recommend upgrading to the listed fixed versions. (dbugs.ptsecurity.com)

4) Deployment of wrong handler (CWE‑430) — CVE‑2025‑3946​

Incorrect assignment of packet handlers or dispatch functions can lead to unexpected code paths being executed for crafted inputs. In OneWireless WDM’s CDA, this results in malformed packets being processed by handlers not designed to validate them, a classic route to memory corruption and remote code execution. Public CVE records and vulnerability aggregators show high impact ratings and vendor‑recommended updates.

---

Risk evaluation and operational impact​

Successful exploitation of these vulnerabilities could enable:

• Remote code execution (RCE) on OneWireless WDM instances, allowing adversaries to run arbitrary code within the CDA process context.
• Denial of service (DoS) by crashing packet handlers or forcing memory exhaustion or module faults.
• Information disclosure where buffer overread or buffer‑reuse exposes sensitive telemetry, configuration, or credential material.

The attack vector is network for all four CVEs and the public severity assessments emphasize remote exploitability and low attack complexity in many scenarios — meaning that exposed WDM instances on flat or poorly segmented networks are at real risk. This is consistent with other ICS advisories that flag remote, internet‑accessible devices as the highest‑priority targets for remediation. (dbugs.ptsecurity.com)
Practical consequences for industrial environments:

• Loss of availability for field wireless devices and sensors managed by OneWireless WDM can degrade process monitoring and control.
• RCE on a management plane component creates a pivot point into other Experion PKS subsystems or adjacent OT/IT networks.
• In chemical and energy sectors (both named as critical infrastructure deployments), such impacts can cascade into safety, environmental, and regulatory incidents.

---

Confirming the facts: what independent sources say​

Key technical claims and version remediation were cross‑checked against multiple independent sources:

• CISA’s vulnerability bulletins list the Honeywell OneWireless WDM findings and point to the same fixed OneWireless releases (R322.5 and R331.1) and Experion PKS hotfixes. CISA categorizes the integer‑underflow item as high‑severity in weekly summaries.
• NVD/CVE database entries and third‑party aggregators (CVE Details, Positive Technologies writeups) independently enumerate CVE‑2025‑2521, CVE‑2025‑2522, CVE‑2025‑2523, and CVE‑2025‑3946 with similar descriptions and impacted version ranges, reaffirming Honeywell’s mitigation guidance. (cvedetails.com, nvd.nist.gov, cisa.gov, cisa.gov, nvd.nist.gov, nvd.nist.gov, cisa.gov, nvd.nist.gov, Honeywell OneWireless Wireless Device Manager (WDM) | CISA