Vulnerability-Lookup

CVE-2026-5433 (GCVE-0-2026-5433)

Vulnerability from cvelistv5 – Published: 2026-05-21 08:35 – Updated: 2026-07-30 16:50

Title

Improper sanitization

Summary

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE‑77 – Improper Neutralization of Special Elements
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Honeywell

References

1 reference

URL	Tags
https://www.honeywell.com/us/en/product-security

Impacted products

1 product

Vendor	Product	Version
Honeywell International Inc.	Control Network Module (CNM)	Affected: 100.1 , ≤ 110.2 (cpe)

Credits

Andreas Krämer, BASF Digital Solutions GmbH Martin Floeck, BASF Digital Solutions GmbH Stefan Stahl, BASF Digital Solutions GmbH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T12:38:39.246019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T16:50:21.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Control Network Module (CNM)",
          "vendor": "Honeywell International Inc.",
          "versions": [
            {
              "lessThanOrEqual": "110.2",
              "status": "affected",
              "version": "100.1",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andreas Kr\u00e4mer, BASF Digital Solutions GmbH"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Martin Floeck, BASF Digital Solutions GmbH"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Stahl, BASF Digital Solutions GmbH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHoneywell Control\nNetwork Module (CNM)\u0026nbsp;contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).\u0026nbsp;\u003c/p\u003e\u003cp\u003eHoneywell\nrecommends updating to the most recent version of this product, service or\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].\u003c/p\u003e"
            }
          ],
          "value": "Honeywell Control\nNetwork Module (CNM)\u00a0contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).\u00a0\n\n\n\nHoneywell\nrecommends updating to the most recent version of this product, service or\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2]."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC\u2011248 \u2013 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE\u201177 \u2013 Improper Neutralization of Special Elements",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T14:03:02.626Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "url": "https://www.honeywell.com/us/en/product-security"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper sanitization",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2026-5433",
    "datePublished": "2026-05-21T08:35:31.438Z",
    "dateReserved": "2026-04-02T16:12:22.574Z",
    "dateUpdated": "2026-07-30T16:50:21.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5433",
      "date": "2026-08-06",
      "epss": "0.00971",
      "percentile": "0.58571"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5433\",\"sourceIdentifier\":\"psirt@honeywell.com\",\"published\":\"2026-05-21T09:16:30.270\",\"lastModified\":\"2026-07-30T19:18:33.750\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Honeywell Control\\nNetwork Module (CNM)\u00a0contains command injection vulnerability\\nin the web interface. An attacker could exploit this vulnerability via command\\ndelimiters, potentially resulting in Remote Code Execution (RCE).\u00a0\\n\\n\\n\\nHoneywell\\nrecommends updating to the most recent version of this product, service or\\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].\"}],\"affected\":[{\"source\":\"psirt@honeywell.com\",\"affectedData\":[{\"vendor\":\"Honeywell International Inc.\",\"product\":\"Control Network Module (CNM)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"100.1\",\"lessThanOrEqual\":\"110.2\",\"versionType\":\"cpe\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@honeywell.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-21T12:38:39.246019Z\",\"id\":\"CVE-2026-5433\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"references\":[{\"url\":\"https://www.honeywell.com/us/en/product-security\",\"source\":\"psirt@honeywell.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5433\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-21T12:38:39.246019Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-21T12:38:46.162Z\"}}], \"cna\": {\"title\": \"Improper sanitization\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Andreas Kr\\u00e4mer, BASF Digital Solutions GmbH\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Martin Floeck, BASF Digital Solutions GmbH\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Stefan Stahl, BASF Digital Solutions GmbH\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC\\u2011248 \\u2013 Command Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Honeywell International Inc.\", \"product\": \"Control Network Module (CNM)\", \"versions\": [{\"status\": \"affected\", \"version\": \"100.1\", \"versionType\": \"cpe\", \"lessThanOrEqual\": \"110.2\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.honeywell.com/us/en/product-security\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Honeywell Control\\nNetwork Module (CNM)\\u00a0contains command injection vulnerability\\nin the web interface. An attacker could exploit this vulnerability via command\\ndelimiters, potentially resulting in Remote Code Execution (RCE).\\u00a0\\n\\n\\n\\nHoneywell\\nrecommends updating to the most recent version of this product, service or\\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eHoneywell Control\\nNetwork Module (CNM)\u0026nbsp;contains command injection vulnerability\\nin the web interface. An attacker could exploit this vulnerability via command\\ndelimiters, potentially resulting in Remote Code Execution (RCE).\u0026nbsp;\u003c/p\u003e\u003cp\u003eHoneywell\\nrecommends updating to the most recent version of this product, service or\\noffering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE\\u201177 \\u2013 Improper Neutralization of Special Elements\"}]}], \"providerMetadata\": {\"orgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"shortName\": \"Honeywell\", \"dateUpdated\": \"2026-07-27T14:03:02.626Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5433\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T16:50:21.691Z\", \"dateReserved\": \"2026-04-02T16:12:22.574Z\", \"assignerOrgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"datePublished\": \"2026-05-21T08:35:31.438Z\", \"assignerShortName\": \"Honeywell\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-5433

Vulnerability from fkie_nvd - Published: 2026-05-21 09:16 - Updated: 2026-06-02 14:16

Severity

Summary

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
    }
  ],
  "id": "CVE-2026-5433",
  "lastModified": "2026-06-02T14:16:55.843",
  "metrics": {},
  "published": "2026-05-21T09:16:30.270",
  "references": [],
  "sourceIdentifier": "psirt@honeywell.com",
  "vulnStatus": "Rejected"
}

GHSA-WW6Q-R9C5-M444

Vulnerability from github – Published: 2026-05-21 09:32 – Updated: 2026-07-30 21:31

Details

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-5433"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-21T09:16:30Z",
    "severity": "CRITICAL"
  },
  "details": "Honeywell Control\nNetwork Module (CNM)\u00a0contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).",
  "id": "GHSA-ww6q-r9c5-m444",
  "modified": "2026-07-30T21:31:25Z",
  "published": "2026-05-21T09:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5433"
    },
    {
      "type": "WEB",
      "url": "https://process.honeywell.com"
    },
    {
      "type": "WEB",
      "url": "https://www.honeywell.com/us/en/product-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-5433 (GCVE-0-2026-5433)

FKIE_CVE-2026-5433

GHSA-WW6Q-R9C5-M444

Tags

Sightings

Nomenclature