CVE-2026-5433

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.honeywell.com/us/en/product-security

Configurations

No configuration.

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El Módulo de Red de Control (CNM) de Honeywell contiene una vulnerabilidad de inyección de comandos en la interfaz web. Un atacante podría explotar esta vulnerabilidad mediante delimitadores de comandos, lo que podría resultar en Ejecución Remota de Código (RCE).

Information

Published : 2026-05-21 09:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-5433

Mitre link : CVE-2026-5433

CVE.ORG link : CVE-2026-5433

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-5433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5433", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-21T12:38:39.246019Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "psirt@honeywell.com", "affectedData": [{"vendor": "Honeywell International Inc.", "product": "Control Network Module (CNM)", "versions": [{"status": "affected", "version": "100.1", "versionType": "cpe", "lessThanOrEqual": "110.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-21T09:16:30.270", "references": [{"url": "https://www.honeywell.com/us/en/product-security", "source": "psirt@honeywell.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Honeywell Control\nNetwork Module (CNM)\u00a0contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).\u00a0\n\n\n\nHoneywell\nrecommends updating to the most recent version of this product, service or\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2]."}, {"lang": "es", "value": "El M\u00f3dulo de Red de Control (CNM) de Honeywell contiene una vulnerabilidad de inyecci\u00f3n de comandos en la interfaz web. Un atacante podr\u00eda explotar esta vulnerabilidad mediante delimitadores de comandos, lo que podr\u00eda resultar en Ejecuci\u00f3n Remota de C\u00f3digo (RCE)."}], "lastModified": "2026-10-14T20:10:00.190", "sourceIdentifier": "psirt@honeywell.com"}