CVE-2026-13249

Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

State: Published
Severity: 9.8 Critical
Published: Sep 24, 2026
Updated: Sep 24, 2026
Reserved: Jun 24, 2026

Description

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.

An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Honeywell

Weaknesses

CWE-306 Missing authentication for critical function
CWE-434 Unrestricted upload of file with dangerous type
CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
PD45 Industrial PrinterHoneywell	F10.19.010040 to before F10.22.030745Affected

References

https://www.honeywell.com/us/en/legal/product-security#security-notices

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.