CVE Intelligence
Analysis AI-assisted

CVE-2026-5433: Honeywell Control Network Module (CNM): command injection in web interface

Honeywell Control Network Module (CNM) contains a command injection flaw (CWE-77) in its web interface that could potentially lead to remote code execution. The record rates it critical with a CVSS 3.1 base score of 9.1. The record lists affected versions from 100.1 to 110.2 and no fixed version, and the vendor recommends moving to its most recent release.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Honeywell's Control Network Module (CNM) contains a command injection vulnerability (CWE-77) in its web interface. According to the record, an attacker could exploit it through command delimiters, potentially resulting in remote code execution. The CVSS 3.1 base score in the record is 9.1, which is rated critical.

Impact

  • Successful exploitation could potentially lead to remote code execution on the affected device.
  • The CVSS vector in the record indicates a network attack vector, low attack complexity, high privileges required, no user interaction, a changed scope, and high impact on confidentiality, integrity and availability.
  • The SSVC data in the record rates technical impact as total.

Affected products and versions

  • Honeywell International Inc. Control Network Module (CNM).
  • The record lists the affected range as 100.1 to 110.2. The description names 100.1, 101.1, 110.1 and 110.2 as affected.
  • The record contains no fixed version. The description says Honeywell recommends updating to the most recent version, identified there as 200.1. Whether 200.1 resolves this specific issue is not confirmed by the record.

Exploitation status

  • The record shows the vulnerability is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC lists exploitation as none and automatable as no.
  • The EPSS probability is 0.01551 with a percentile of 0.7445, as recorded.

Remediation and mitigation

  • Inventory all CNM deployments and identify any running versions within the affected range.
  • Review the Honeywell product security page and plan an update to the most recent release the vendor recommends.
  • Restrict access to the web interface to trusted administrative networks until the device is updated.
  • Limit the number of accounts holding high privileges, since the CVSS vector requires them for exploitation.
  • Where the update cannot be applied immediately, document the risk and apply compensating network controls.

Detection guidance

  • Review web interface logs for unexpected requests or unusual input patterns.
  • Monitor CNM hosts for unexpected processes, configuration changes or outbound connections.
  • Correlate alerts from these sources with asset inventory to prioritize affected devices.

Limitations of the available information

  • The record lists no fixed version and no patch details.
  • The source status is Undergoing Analysis, so details may change.
  • The record contains a single vendor reference and no independent technical analysis.
  • The affected version list appears in both the range and the description, and the record does not clarify any gaps between them.

Frequently asked questions

What is the vulnerability in Honeywell CNM?

The record describes a command injection flaw (CWE-77) in the CNM web interface that could potentially lead to remote code execution.

Which versions are affected?

The record lists the range 100.1 to 110.2, and the description names 100.1, 101.1, 110.1 and 110.2 as affected.

Is there a fixed version?

The record lists no fixed version. The vendor recommends updating to the most recent version, identified as 200.1, but the record does not confirm that this resolves the issue.

Is this vulnerability being exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.