Honeywell PD45 EUVD-2026-86350

Exploitation requires network access to the Honeywell PD45 Industrial Printer web management interface running firmware F10.19.010040; no authentication, credentials, or user interaction are needed (CWE-306, PR:N/UI:N). The single concrete prerequisite is reachability of that HTTP management interface. The primary limiting factor is exposure: as an OT/industrial printer, this interface is typically deployed on internal warehouse/manufacturing networks rather than internet-facing, so an attacker generally needs an existing network foothold. Patched firmware F10.22.030745 remediates the flaw, so only unpatched devices at the affected version are exploitable.

Every core signal points to maximum severity: CVSS 3.1 base 9.8 with AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H describes an unauthenticated, low-complexity, network-reachable RCE requiring no user interaction, and CWE-306 (missing authentication) matches the description's 'without requiring authentication' arbitrary file upload. This is a genuine high-priority issue, not an inflated score - the vector and the description are fully consistent. However, the softening signals matter for prioritization: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' rather than active/widespread. The realistic risk is heavily governed by exposure: the PD45 is an OT/industrial label printer whose web management interface is typically on internal warehouse/manufacturing networks rather than the public internet, so 'network' reachability in practice usually means an attacker already on the LAN. Net assessment: critical technical impact and trivial exploitability, but likely opportunistic/targeted rather than mass-exploited given the niche device footprint and lack of exploitation telemetry.

An attacker with network reach to the printer's web management interface (e.g., a foothold on the same OT/warehouse LAN) sends an HTTP request that uploads an attacker-controlled file without any credentials, then triggers execution of the uploaded file to run commands on the device. No POC is present in the provided data, and no authentication or user interaction is required per the CVSS vector (PR:N/UI:N), so a single request against a default deployment is sufficient. Success yields full compromise of the printer (C:H/I:H/A:H), usable as a pivot into the industrial network.