What is the CVSS score of CVE-2026-5433?

CVE-2026-5433 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Honeywell CNM are affected by CVE-2026-5433?

Honeywell Control Network Module (CNM) versions 100.1-110.2 contain a critical remote code execution vulnerability allowing authenticated high-privilege users to execute arbitrary OS commands through…. A patch is available.

How to fix or mitigate CVE-2026-5433?

Within 24 hours: Inventory all CNM instances and identify those running versions 100.1-110.2; implement network access restrictions to the web interface for essential personnel only. Within 7 days: Apply Honeywell's released patch to all vulnerable CNM devices via process.honeywell.com. Within 30 days: Verify patch deployment across the entire CNM infrastructure and confirm no instances remain on vulnerable versions.

Honeywell CNM CVE-2026-5433

EUVD-2026-31253 CRITICAL

2026-05-21 Honeywell

GHSA-ww6q-r9c5-m444

Honeywell RCE Command Injection

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 09:30 vuln.today

DescriptionCVE.org

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE).

AnalysisAI

Remote code execution in Honeywell Control Network Module (CNM) versions 100.1 through 110.2 allows authenticated high-privilege attackers to inject arbitrary OS commands through the device's web interface using command delimiters. The flaw carries a CVSS 9.1 rating due to scope change and full CIA impact, and no public exploit identified at time of analysis, though the industrial-control context makes any RCE highly consequential. Honeywell has released a patch via its process.honeywell.com portal.

Technical ContextAI

The Control Network Module (CNM) is a Honeywell industrial communications gateway used in Experion PKS and related distributed control system (DCS) deployments to bridge process-control networks. The vulnerability is a classic command injection (CWE-78-class issue, though CWE is unlisted in source data) in the device's HTTP management interface: user-supplied input is concatenated into a shell or system invocation without adequate sanitization of delimiter characters such as ';', '|', '&', '$()', or backticks, allowing attacker-controlled strings to break out of the intended argument and execute additional commands in the underlying OS context. The affected CPE is cpe:2.3:a:honeywell_international_inc.:control_network_module_(cnm), confirming this is a Honeywell-branded application/firmware component rather than a generic third-party library.

RemediationAI

Apply the Honeywell-released patch obtained through the vendor's process automation support portal at https://process.honeywell.com/ - the input confirms a patch is available but does not name the fixed firmware build, so operators must retrieve the exact fixed version from Honeywell's security notification matched to their CNM revision. Until the patch is deployed, restrict network reachability to the CNM web interface by placing the device behind a management VLAN or jump host so only a hardened engineering workstation can reach the HTTP service, rotate and strengthen administrative credentials to neutralize the PR:H precondition, and enable logging/alerting on the CNM management interface to detect anomalous command strings; the trade-off of network segmentation is added latency for legitimate engineering access and potential disruption to remote diagnostic tooling, while credential rotation can temporarily break automation scripts that hardcode the old password.