Vulnerability · Published May 21, 2026 · Assigned by Honeywell
CVE-2026-5433Improper sanitization
Critical 9.1
In plain English
A critical-severity command injection in Control Network Module (CNM) from Honeywell International Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Honeywell International Inc. | Control Network Module (CNM) | 100.1 – through 110.2 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H