Medium severity · published May 21, 2026
CVE-2026-5434
Improper storage of sensitive information
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
Honeywell Control
Network Module (CNM) contains
insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing
system files, potentially resulting in unintended
access to protected data.
Honeywell
recommends updating to the most recent version of this product, service or
offering [200.1]. The CNM versions affected are from [100.1, 101.1, 110.1, and 110.2].
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Control Network Module (CNM) · Honeywell International Inc.
100.1 through 110.2 · source: vendor
Affected product
CN
Control Network Module (CNM)
Honeywell International Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5434
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5434
www.honeywell.com
https://www.honeywell.com/us/en/product-security
More from Control Network Module (CNM)
9.1
CVE-2026-5433
Improper sanitization
