Pd45 Industrial Printer
Monthly
Authenticated remote code execution in the Honeywell PD45 Industrial Printer web management interface lets a user holding an admin or itadmin account write arbitrary files and run commands on the device by feeding Intermec Fingerprint programming-language instructions directly to the printer's internal command interpreter. Only firmware version F10.19.010040 is identified as affected, and exploitation is not possible pre-authentication: valid administrative credentials and network reachability to the management interface are both mandatory, which is why our independent assessment rates the privilege requirement as High (PR:H) rather than the vendor's Low. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Honeywell addressed the flaw in firmware F10.22.030745.
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reachable attacker upload attacker-controlled files through the web management interface and execute them as malicious files and commands. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects the complete absence of authentication or user interaction required, consistent with CWE-306 missing authentication for a critical function, so a single unauthenticated HTTP request path is enough to gain code execution on the device. Honeywell has released fixed firmware F10.22.030745; no public exploit code has been identified at time of analysis, but exposure is constrained mainly by the fact that these industrial printers typically sit on internal warehouse or manufacturing networks rather than the public internet, meaning an attacker usually needs an existing network foothold or adjacent access first.
Authenticated remote code execution in the Honeywell PD45 Industrial Printer web management interface lets a user holding an admin or itadmin account write arbitrary files and run commands on the device by feeding Intermec Fingerprint programming-language instructions directly to the printer's internal command interpreter. Only firmware version F10.19.010040 is identified as affected, and exploitation is not possible pre-authentication: valid administrative credentials and network reachability to the management interface are both mandatory, which is why our independent assessment rates the privilege requirement as High (PR:H) rather than the vendor's Low. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Honeywell addressed the flaw in firmware F10.22.030745.
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reachable attacker upload attacker-controlled files through the web management interface and execute them as malicious files and commands. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects the complete absence of authentication or user interaction required, consistent with CWE-306 missing authentication for a critical function, so a single unauthenticated HTTP request path is enough to gain code execution on the device. Honeywell has released fixed firmware F10.22.030745; no public exploit code has been identified at time of analysis, but exposure is constrained mainly by the fact that these industrial printers typically sit on internal warehouse or manufacturing networks rather than the public internet, meaning an attacker usually needs an existing network foothold or adjacent access first.