CVE-2026-5433

CRITICAL

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in R...

Affects 0 products across 1 vendor.

BCS6.95
CVSS 3.19.1
EPSS0.3%
Percentile55th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, high privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ SAGE Intelligence — CITED Relevance Research Team

The Honeywell Control Network Module (CNM) contains a command injection vulnerability in its web interface, which could allow an attacker to achieve Remote Code Execution (RCE). The vulnerability has a CVSS score of 9.1, indicating a high severity level. Immediate attention is required to mitigate the risk of potential exploitation.

BSID: BS-2026-GLOBAL-154097-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-5433?
The Honeywell Control Network Module (CNM) contains a command injection vulnerability in its web interface, which could allow an attacker to achieve Remote Code Execution (RCE). The vulnerability has a CVSS score of 9.1, indicating a high severity level. Immediate attention is required to mitigate the risk of potential exploitation.
What is the CVSS score for CVE-2026-5433?
CVE-2026-5433 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2026-5433 actively exploited?
No confirmed active exploitation of CVE-2026-5433 as of 2026-07-28.
How do I remediate CVE-2026-5433?
Priority: HIGH. PSIRT: [email protected]
What systems are affected by CVE-2026-5433?
CVE-2026-5433 affects: Honeywell.
What NERC-CIP standard applies to CVE-2026-5433?
NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 as it allows unauthorized access to the control network module, which could compromise the security of the electronic security perimeter.
What IEC 62443 requirement maps to CVE-2026-5433?
IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves a command injection vulnerability that could lead to remote code execution, compromising the integrity and availability of the control system.
Vulnerability Details
CVE IDCVE-2026-5433
BSIDBS-2026-GLOBAL-154097-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published2026-05-21
Last Modified2026-07-27
ICS Relevance55%
Verticals
ICS-OT
SourceNVD
Official Description

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE).  Honeywell recommends updating to the most recent version of this product, service or offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting command delimiters into the web interface of the Honeywell Control Network Module (CNM). This can lead to Remote Code Execution (RCE), allowing the attacker to execute arbitrary commands on the affected system.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductFixed Version
Honeywell —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 67 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
● Virtual Patch — CITED Relevance SAGE Engine MEDIUM CONFIDENCE

Implement strict input validation and sanitization for all web interface inputs to prevent command injection attacks. Consider deploying a Web Application Firewall (WAF) to monitor and block suspicious traffic.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 as it allows unauthorized access to the control network module, which could compromise the security of the electronic security perimeter.
IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves a command injection vulnerability that could lead to remote code execution, compromising the integrity and availability of the control system.

Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.

SAGE Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash4aac03e432221e6d6b7d7ce1eec5a59506861b2c2e44cb3dcbae6703e41d828da8f6980a2edc6544431fcd163143e3c4b7f1d34cc2e070b4ad757316e908ae31
Related CVEs affecting Honeywell
CVE-2021-38397 10.0 Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable ... CVE-2026-3611 10.0 The Honeywell IQ4x building management controller, exposes its full web-based... CVE-2007-2938 10.0 Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader... CVE-2015-0984 10.0 Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL... CVE-2022-31481 10.0 An unauthenticated attacker can send a specially crafted update file to the d...
View all Honeywell CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →