CVE-2026-13248

Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface

State: Published
Severity: 8.8 High
Published: Sep 24, 2026
Updated: Sep 24, 2026
Reserved: Jun 24, 2026

Description

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.

An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Honeywell

Weaknesses

CWE-73 External control of file name or path
CWE-434 Unrestricted upload of file with dangerous type
CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
PD45 Industrial PrinterHoneywell	F10.19.010040 to before F10.22.030745Affected

References

https://www.honeywell.com/us/en/legal/product-security#security-notices

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.