CVE-2026-5433CWE-77command-injection

CVE-2026-5433

Critical · published May 21, 2026

CVSS v3.1

9.1

EPSS

Percentile

74.9

In the wild

Unconfirmed

What it is

Honeywell Control

Network Module (CNM) contains command injection vulnerability

in the web interface. An attacker could exploit this vulnerability via command

delimiters, potentially resulting in Remote Code Execution (RCE).

Honeywell

recommends updating to the most recent version of this product, service or

offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01551 · 74.9th percentile
Weakness: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-05-21T13:16Z

References (1)

EPSS history

Timeline