What is CVE-2026-5433?

CVE-2026-5433 is a critical-severity vulnerability in Honeywell Control_network_module, classified under Command Injection. CVSS score: 9.1/10. Published 2026-05-21.

How severe is CVE-2026-5433?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in Honeywell Control_network_module

CVE-2026-5433

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). Honeywell …

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (55.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Honeywell Control_network_module
Honeywell Control_network_module_firmware
Honeywell International Inc. Control Network Module (Cnm) — versions 100.1

Weakness classification (CWE)

CWE-77 — Command Injection

References

psirt@honeywell.com (patch, Vendor Advisory)
psirt@honeywell.com

Frequently asked questions

What is CVE-2026-5433?: CVE-2026-5433 is a critical-severity vulnerability in Honeywell Control_network_module, classified under Command Injection. CVSS score: 9.1/10. Published 2026-05-21.
How severe is CVE-2026-5433?: Critical severity. CVSS v3 base score is 9.1 out of 10.