CVE-2026-5434

Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing system files, potentially resulting in unintended access to protected data. Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.honeywell.com/us/en/product-security

Configurations

No configuration.

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Control de Honeywell Módulo de Red (CNM) contiene inserción de información sensible en un directorio no deseado. Un atacante podría explotar esta vulnerabilidad mediante el sondeo de archivos del sistema, lo que podría resultar en acceso no deseado a datos protegidos.

Information

Published : 2026-05-21 09:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-5434

Mitre link : CVE-2026-5434

CVE.ORG link : CVE-2026-5434

JSON object : View

Products Affected

No product.

CWE

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

{"id": "CVE-2026-5434", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5434", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T12:06:31.149864Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@honeywell.com", "affectedData": [{"vendor": "Honeywell International Inc.", "product": "Control Network Module (CNM)", "versions": [{"status": "affected", "version": "100.1", "versionType": "cpe", "lessThanOrEqual": "110.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-21T09:16:30.410", "references": [{"url": "https://www.honeywell.com/us/en/product-security", "source": "psirt@honeywell.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "Honeywell Control\nNetwork Module (CNM)\u00a0contains\ninsertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing\nsystem files, potentially resulting in unintended\naccess to protected data.\n\n\n\nHoneywell\nrecommends updating to the most recent version of this product, service or\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2]."}, {"lang": "es", "value": "Control de Honeywell\nM\u00f3dulo de Red (CNM) contiene\ninserci\u00f3n de informaci\u00f3n sensible en un directorio no deseado. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el sondeo de archivos del sistema, lo que podr\u00eda resultar en acceso no deseado a datos protegidos."}], "lastModified": "2026-10-14T20:10:00.190", "sourceIdentifier": "psirt@honeywell.com"}