CVE-2026-13249: Honeywell PD45 RCE
TL;DR - CVE-2026-13249 is a critical unauthenticated arbitrary-file-upload vulnerability that can lead to remote code execution on Honeywell PD45 printers. - Honeywell PD45 firmware F10.19.010040 is identified as affected; upgrade to F10.22.030745 or later. - No public PoC or confirmed in-the-wild exploitation was identified, but management access should be restricted immediately.
Summary
CVE-2026-13249 is a critical Honeywell PD45 vulnerability affecting the printer’s web-management interface. An unauthenticated attacker can upload attacker-controlled files. According to the available vulnerability description, successful exploitation could execute malicious files or commands on the device.
| Field | Finding |
|---|---|
| CVE ID | CVE-2026-13249 |
| Product | Honeywell PD45 Industrial Printer |
| CVSS | 9.8, Critical |
| Attack vector | Remote web-management interface; exact CVSS vector was not supplied in the reviewed NVD API response |
| Authentication required | No |
| Vulnerable firmware identified | F10.19.010040 |
| Fixed firmware | F10.22.030745 |
| Patch available | Yes |
| CISA KEV status | Not listed at the time of the reviewed check |
| Public PoC | None identified |
| Confirmed exploitation in the wild | None identified |
Analyst’s Take: Treat the management interface as the immediate control point. The absence of a public PoC or CISA KEV listing does not offset the combination of remote reachability, no authentication requirement, arbitrary file upload, and potential command execution. Restrict access now, then move affected devices to F10.22.030745 or later.
CISA Known Exploited Vulnerabilities catalog status is not a measure of low risk. A printer management interface reachable from an enterprise network can give an attacker a foothold in operational, manufacturing, logistics, or office environments. Remote reachability, no authentication requirement, arbitrary file upload, and potential command execution together warrant expedited remediation.
Root Cause
The reported root cause is an arbitrary file-upload weakness in the PD45 web-management interface. The interface accepts attacker-controlled files without requiring authentication. The available description does not specify the vulnerable endpoint, accepted file types, upload directory, validation logic, or the precise mechanism by which uploaded content is executed.
Those implementation details have not been published in the reviewed material. Defenders should therefore avoid assuming that filtering a particular extension will fully mitigate the problem. File renaming, alternate content types, path manipulation, or other upload behaviors could remain relevant unless Honeywell documents a narrower workaround. Treat the entire management interface as exposed until the firmware is updated or access is restricted.
The risk is greater for printers on flat networks. Industrial and label printers are often managed through shared operational segments, and their web interfaces may be reachable by workstations, production systems, or remote-access infrastructure. Depending on the device’s network placement and firmware capabilities, a compromise could affect the printer itself and potentially support lateral movement, credential theft, malicious printing, or disruption of production workflows.
Organizations can also review what a jump server is when designing a controlled path for printer administration.
Who’s Exposed
The specifically identified affected product is the Honeywell PD45 Industrial Printer running firmware F10.19.010040. The available NVD information identifies that exact firmware version rather than a complete affected range such as “all versions before X.” Organizations should not automatically conclude that every earlier or later firmware build is affected or safe without checking Honeywell’s current product-security guidance.
The identified fixed release is F10.22.030745. Systems running an unlisted PD45 firmware version require validation; they should not be presumed secure. Confirm the installed firmware through the printer’s administrative interface, asset-management platform, configuration export, or an approved inventory method. Record the device model, firmware version, management IP address, and network segment before making changes.
The sources reviewed do not identify other Honeywell printer models as affected by this CVE. They also do not provide a complete hardware revision matrix or regional product qualification list. Organizations operating PD45 variants should verify applicability with Honeywell before closing the finding, particularly where firmware naming or maintenance releases differ between deployments.
Severity Breakdown
The NVD record reports a CVSS base score of 9.8, rated Critical. The practical risk drivers are clear even though the exact vector string was not included in the supplied NVD API response: the vulnerable service is a web-management interface, authentication is not required, and exploitation may result in arbitrary file or command execution.
| CVSS-related factor | Confirmed information |
|---|---|
| Base score | 9.8 |
| Severity | Critical |
| Attack surface | Web-management interface |
| Authentication | Not required |
| Exploit result | Potential execution of malicious files and commands |
| Exact CVSS vector | Not available in the reviewed API response |
| Vector interpretation | Must be verified directly in the NVD record |
Do not fabricate or reverse-engineer the missing vector from the score. The exact vector determines the formal values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability. Analysts should retrieve the current NVD record and use the published vector for quantitative prioritization, scanner exceptions, and risk calculations.
The missing vector string does not change the operational priority. Unauthenticated remote code execution on a network appliance or industrial endpoint should be handled as a critical infrastructure exposure, especially when the device is reachable from user networks, remote administration systems, or the internet.
Exploitation Status
The sources reviewed did not identify a public exploit or proof-of-concept repository for CVE-2026-13249. No GitHub proof of concept, exploit write-up, or reproducible technical demonstration was identified in the supplied research. A public PoC is not required for the vulnerability to present risk.
CVE-2026-13249 was also reported as not listed in the CISA KEV catalog at the time of the check. No CISA KEV date added, remediation due date, required action, or ransomware-campaign flag is available. No vendor-confirmed exploitation campaign or reliable report of exploitation in the wild was identified.
The current assessment is: no confirmed in-the-wild exploitation identified, no public PoC identified, and no CISA KEV listing identified. These are status findings based on the sources reviewed, not guarantees that exploitation has never occurred. Continue monitoring Honeywell advisories, NVD updates, CISA KEV changes, and internal telemetry.
Sources
The primary source is the NVD record for CVE-2026-13249:
The NVD record identifies the Honeywell PD45 Industrial Printer, firmware F10.19.010040 as affected, and firmware F10.22.030745 as containing the fix. It also reports the CVSS base score of 9.8 and provides the vulnerability description.
Honeywell’s general product-security portal is the relevant vendor reference identified in the available record:
No separate CVE-specific Honeywell advisory URL was identified in the supplied research. The exact CVSS vector, complete affected-version range, vulnerable request path, and vendor-specific detection indicators should be verified against any subsequent Honeywell advisory or updated NVD record before being used for detailed threat hunting or formal risk scoring.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Begin with asset discovery. Identify every Honeywell PD45 printer, determine its management IP address, and collect the installed firmware version. Prioritize devices running F10.19.010040, devices with management interfaces reachable from broad internal segments, and devices exposed through internet-facing NAT, VPN, remote administration, or jump-host paths.
Network monitoring should focus on unauthenticated or unexpected HTTP and HTTPS access to printer management addresses. Look for multipart file-upload requests, unusual methods, requests from workstations that do not normally administer printers, and outbound connections from printer IP addresses after an upload attempt. The exact vulnerable URI and request format have not been disclosed, so detection should not depend on one assumed endpoint.
Technical Notes
A generic network detection query can identify likely upload activity without claiming a CVE-specific signature. Adapt field names to the organization’s proxy, firewall, IDS, or Zeek schema:
http.method IN ("POST", "PUT")
AND http.request_body_len > 0
AND http.content_type CONTAINS "multipart/form-data"
AND destination.ip IN honeywell_pd45_management_assets
A second useful query is for unexpected traffic from printers after administrative activity:
src.ip IN honeywell_pd45_management_assets
AND event_time > upload_or_admin_request_time
AND destination.port IN (21, 22, 80, 443, 8080, 8443)
AND destination.ip NOT IN approved_printer_management_hosts
These queries are behavioral indicators, not confirmed exploit signatures. Printer logs may use vendor-specific formats, may not record upload contents, and may be unavailable through the network SIEM. Preserve relevant web-server, firewall, reverse-proxy, authentication, and endpoint telemetry where available. Review failed and successful management requests, unexpected file names, administrative changes, device restarts, configuration changes, and new outbound connections.
Remediation Steps
Upgrade affected PD45 printers running F10.19.010040 to Honeywell PD45 firmware F10.22.030745 or later. The available record identifies F10.22.030745 as containing the fix. Before deployment, obtain the firmware through Honeywell’s authorized support or product-security channels, validate the file and release applicability, and follow the vendor’s documented upgrade procedure.
The reviewed sources do not provide a Honeywell-specific command-line firmware-installation command. Do not use an invented CLI command or assume that a generic printer firmware utility is supported. Use the device’s documented administrative upgrade workflow or Honeywell support process, and retain the upgrade result and resulting firmware version as remediation evidence.
Until upgrades are complete, restrict the web-management interface to trusted administration networks. Do not expose it directly to the internet. For remote administrators, use an approved business VPN or controlled access service such as Check NordVPN pricing →, configured according to organizational security requirements. A VPN should not replace network segmentation, source allowlisting, or multifactor authentication where those controls are available.
If an immediate firewall change is needed, a Linux-based enforcement point could use a source allowlist similar to the following, with the interface and addresses replaced for the environment:
Technical Notes
# Example nftables workaround: allow only the printer-management subnet
nft add rule inet filter forward ip daddr <PD45_MGMT_IP> tcp dport { 80, 443 } ip saddr != <TRUSTED_ADMIN_SUBNET> reject
For environments using a firewall appliance, implement the equivalent policy: permit HTTP or HTTPS management traffic only from approved administrator subnets, deny all other sources, and block inbound internet access to the printer. Apply the rule in the correct direction for the deployment and verify that printing traffic is not unintentionally disrupted.
Additional temporary controls include placing affected printers in an isolated VLAN, removing unnecessary default routes, limiting east-west access, and requiring administration through a controlled jump host. A zero-trust security model can help formalize identity, device, and network-based restrictions around management access.
After upgrading, confirm the reported firmware is F10.22.030745 or later, test printing and management functions, and remove obsolete broad access rules only after validating normal operations.
If compromise is suspected, isolate the printer from the network rather than repeatedly accessing its management interface. Preserve firewall and proxy logs, firmware and configuration records, device logs, and packet captures where available. Coordinate with Honeywell support for device-specific forensic and recovery guidance, and rotate any credentials or secrets that may have been exposed through the affected management environment.