CVE-2026-13248 (GCVE-0-2026-13248)
Vulnerability from cvelistv5
Published
2026-09-24 18:27
Modified
2026-09-24 19:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Honeywell | PD45 Industrial Printer |
Version: F10.19.010040 < F10.22.030745 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:19:35.275464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:19:53.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PD45 Industrial Printer",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "F10.22.030745",
"status": "affected",
"version": "F10.19.010040",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matheus Vianna Silveira"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u0026nbsp;\u003cspan\u003eallows\u0026nbsp;\u003c/span\u003e\u003cspan\u003ean\u0026nbsp;\u003c/span\u003e\u003cspan\u003eauthenticated\u0026nbsp;\u003c/span\u003e\u003cspan\u003euser\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccess\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eor\u0026nbsp;\u003c/span\u003e\u003cspan\u003eitadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccount\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003esubmit\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommands\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewritten\u0026nbsp;\u003c/span\u003e\u003cspan\u003ein\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eIntermec\u0026nbsp;\u003c/span\u003e\u003cspan\u003eFingerprint\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprogramming\u0026nbsp;\u003c/span\u003e\u003cspan\u003elanguage\u0026nbsp;\u003c/span\u003e\u003cspan\u003edirectly\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprinter\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u2019s\u0026nbsp;\u003c/span\u003e\u003cspan\u003einternal\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommand\u0026nbsp;\u003c/span\u003e\u003cspan\u003einterpreter\u003c/span\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u00a0allows\u00a0an\u00a0authenticated\u00a0user\u00a0with\u00a0access\u00a0to\u00a0the\u00a0admin\u00a0or\u00a0itadmin\u00a0account\u00a0to\u00a0submit\u00a0commands\u00a0written\u00a0in\u00a0the\u00a0Intermec\u00a0Fingerprint\u00a0programming\u00a0language\u00a0directly\u00a0to\u00a0the\u00a0printer\u00a0\u2019s\u00a0internal\u00a0command\u00a0interpreter.\u00a0\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted upload of file with dangerous type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:27:33.569Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://www.honeywell.com/us/en/legal/product-security#security-notices"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-13248",
"datePublished": "2026-09-24T18:27:33.569Z",
"dateReserved": "2026-06-24T18:04:28.287Z",
"dateUpdated": "2026-09-24T19:19:53.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13248\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-24T19:19:35.275464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-24T19:19:48.434Z\"}}], \"cna\": {\"title\": \"Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Matheus Vianna Silveira\"}], \"impacts\": [{\"capecId\": \"CAPEC-17\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-17 Using Malicious Files\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Honeywell\", \"product\": \"PD45 Industrial Printer\", \"versions\": [{\"status\": \"affected\", \"version\": \"F10.19.010040\", \"lessThan\": \"F10.22.030745\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.honeywell.com/us/en/legal/product-security#security-notices\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\\u00a0allows\\u00a0an\\u00a0authenticated\\u00a0user\\u00a0with\\u00a0access\\u00a0to\\u00a0the\\u00a0admin\\u00a0or\\u00a0itadmin\\u00a0account\\u00a0to\\u00a0submit\\u00a0commands\\u00a0written\\u00a0in\\u00a0the\\u00a0Intermec\\u00a0Fingerprint\\u00a0programming\\u00a0language\\u00a0directly\\u00a0to\\u00a0the\\u00a0printer\\u00a0\\u2019s\\u00a0internal\\u00a0command\\u00a0interpreter.\\u00a0\\n\\n\\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u0026nbsp;\u003cspan\u003eallows\u0026nbsp;\u003c/span\u003e\u003cspan\u003ean\u0026nbsp;\u003c/span\u003e\u003cspan\u003eauthenticated\u0026nbsp;\u003c/span\u003e\u003cspan\u003euser\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccess\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eor\u0026nbsp;\u003c/span\u003e\u003cspan\u003eitadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccount\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003esubmit\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommands\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewritten\u0026nbsp;\u003c/span\u003e\u003cspan\u003ein\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eIntermec\u0026nbsp;\u003c/span\u003e\u003cspan\u003eFingerprint\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprogramming\u0026nbsp;\u003c/span\u003e\u003cspan\u003elanguage\u0026nbsp;\u003c/span\u003e\u003cspan\u003edirectly\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprinter\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\\u2019s\u0026nbsp;\u003c/span\u003e\u003cspan\u003einternal\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommand\u0026nbsp;\u003c/span\u003e\u003cspan\u003einterpreter\u003c/span\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"CWE-73 External control of file name or path\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434 Unrestricted upload of file with dangerous type\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"shortName\": \"Honeywell\", \"dateUpdated\": \"2026-09-24T18:27:33.569Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-13248\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-24T19:19:53.714Z\", \"dateReserved\": \"2026-06-24T18:04:28.287Z\", \"assignerOrgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"datePublished\": \"2026-09-24T18:27:33.569Z\", \"assignerShortName\": \"Honeywell\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…