CVE-2026-13249 — Honeywell PD45 Unauthenticated File Upload (RCE)

Overview

CVE-2026-13249 affects the Honeywell PD45 Industrial Printer web management interface. Affected firmware from F10.19.010040 through before F10.22.030745 exposes unauthenticated arbitrary file upload on the printer HTTPS web admin. Uploaded content may be executed as commands on the device (RCE). CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

| | | |---|---| | Product | Honeywell PD45 Industrial Printer | | Affected firmware | ≥ F10.19.010040 and < F10.22.030745 | | Fixed firmware | F10.22.030745 | | Interface | Web management (HTTPS) | | Impact | Unauth upload → RCE |

Open source PoC: https://github.com/murrez/CVE-2026-13249

Vendor: Honeywell product security notices

Honeywell’s public advisory does not publish the exact unauthenticated upload URI. The bundled tool fingerprints the device and firmware, optionally scrapes multipart forms under /Manage/ and /Services/, and supports --upload-url from your own capture on a lab unit.

Bundled tool (Python 3)

Member download matches the GitHub repository (poc.py):

• check — Device/firmware fingerprint, management UI probes.
• check --upload-probe — Safe upload attempt when endpoints are discovered (authorized lab only).
• exploit — Supply --upload-url, --field, and optional --verify-url from traffic you captured on hardware you own.
• Mass check — --list targets.txt -j N for inventories under written scope.

pip install -r requirements.txt
python poc.py -u https://10.10.10.50 --mode check
python poc.py -u https://10.10.10.50 --mode check --upload-probe
python poc.py -u https://10.10.10.50 --mode exploit \
  --upload-url "https://10.10.10.50/..." --field file \
  --verify-url "https://10.10.10.50/pocbit_13249.txt"
python poc.py --list targets.example.txt --mode check -j 8

Asset discovery

title="Honeywell" && body="PD45"
ssl.cert.subject.cn="PD45"

Impact

Network-facing PD45 units on factory or logistics networks may allow full device compromise without credentials—label pipelines, warehouse printers, and adjacent VLANs should be treated as sensitive OT.

Remediation

1. Upgrade to firmware F10.22.030745 or newer per Honeywell guidance.
2. Restrict the web UI to management VLANs, VPN, or allowlisted IPs.
3. Monitor for unexpected files or config changes on printers still on legacy firmware.

Legal and ethical use

--upload-probe and --mode exploit write data to the target device. Test only printers you own or have explicit written permission to assess.

References

• NVD — CVE-2026-13249
• GitHub PoC — murrez/CVE-2026-13249