CVE-2026-5433
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
The Honeywell Control Network Module (CNM) contains a command injection vulnerability in the web interface, exploitable by an attacker via command delimiters, potentially leading to remote code execution (RCE).
Risk Assessment
An attacker could take control of the CNM module, potentially disrupting building or industrial automation systems.
Recommendation
Update the Honeywell CNM firmware to version 200.1 or later.
Original NVD description (English source)
Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].