CVE-2026-5433 - Vulnerability Details - OpenCVE

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0026.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://process.honeywell.com/

History

Thu, 21 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 21 May 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-78

Thu, 21 May 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE).
Title		Improper Sanitization in CNM Web Interface
References		https://process.honeywell.com/
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Honeywell

Published: 2026-05-21T08:35:31.438Z

Updated: 2026-05-21T12:38:52.263Z

Reserved: 2026-04-02T16:12:22.574Z

Link: CVE-2026-5433

Vulnrichment

Updated: 2026-05-21T12:38:46.162Z

NVD

Status : Awaiting Analysis

Published: 2026-05-21T09:16:30.270

Modified: 2026-05-21T15:26:35.653

Link: CVE-2026-5433

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-21T11:30:06Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5433", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2026-04-02T16:12:22.574Z", "datePublished": "2026-05-21T08:35:31.438Z", "dateUpdated": "2026-05-21T12:38:52.263Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-05-21T08:35:31.438Z"}, "title": "Improper Sanitization in CNM Web Interface", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE\u201177 \u2013 Improper Neutralization of Special Elements"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "CAPEC\u2011248 \u2013 Command Injection"}]}], "affected": [{"vendor": "Honeywell International Inc.", "product": "Control Network Module (CNM)", "platforms": ["CNM"], "versions": [{"status": "affected", "version": "100.1", "lessThanOrEqual": "110.2", "versionType": "cpe"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Honeywell Control\nNetwork Module (CNM)\u00a0contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Honeywell Control\nNetwork Module (CNM) contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE). </p>"}]}], "references": [{"url": "https://process.honeywell.com/", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Andreas Kr\u00e4mer, BASF Digital Solutions GmbH", "type": "finder"}, {"lang": "en", "value": "Martin Floeck, BASF Digital Solutions GmbH", "type": "finder"}, {"lang": "en", "value": "Stefan Stahl, BASF Digital Solutions GmbH", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T12:38:39.246019Z", "id": "CVE-2026-5433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:38:52.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-21T12:38:39.246019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:38:46.162Z"}}], "cna": {"title": "Improper Sanitization in CNM Web Interface", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Andreas Kr\u00e4mer, BASF Digital Solutions GmbH"}, {"lang": "en", "type": "finder", "value": "Martin Floeck, BASF Digital Solutions GmbH"}, {"lang": "en", "type": "finder", "value": "Stefan Stahl, BASF Digital Solutions GmbH"}], "impacts": [{"descriptions": [{"lang": "en", "value": "CAPEC\u2011248 \u2013 Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Honeywell International Inc.", "product": "Control Network Module (CNM)", "versions": [{"status": "affected", "version": "100.1", "versionType": "cpe", "lessThanOrEqual": "110.2"}], "platforms": ["CNM"], "defaultStatus": "unaffected"}], "references": [{"url": "https://process.honeywell.com/", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Honeywell Control\nNetwork Module (CNM)\u00a0contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE).", "supportingMedia": [{"type": "text/html", "value": "<p>Honeywell Control\nNetwork Module (CNM) contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE). </p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE\u201177 \u2013 Improper Neutralization of Special Elements"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2026-05-21T08:35:31.438Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5433", "state": "PUBLISHED", "dateUpdated": "2026-05-21T12:38:52.263Z", "dateReserved": "2026-04-02T16:12:22.574Z", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "datePublished": "2026-05-21T08:35:31.438Z", "assignerShortName": "Honeywell"}, "dataVersion": "5.2"}