Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Honeywell PD45 printer lets anyone upload and run files

CVE-2026-13249 · published 18 days ago
Summary

The web management screen of the Honeywell PD45 industrial printer (firmware version F10.19.010040) lets anyone upload files without logging in. An attacker could place a malicious file and make the printer execute it, potentially compromising your network. Install the latest firmware (F10.22.030745) or any vendor‑provided update to close the issue and limit printer access to trusted users only.

What to do
  • Update honeywell pd45 industrial printer to version F10.22.030745 or later.
Affected software
VendorProductAffected versions
honeywell pd45 industrial printer < F10.22.030745
Original advisory text
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.


An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-306Missing Authentication for Critical Function
CWE-434Unrestricted File Upload
Timeline
Published24 Sep 2026
Updated11 Oct 2026
First seen24 Sep 2026
Sources
CVE-2026-13249 · NVD
CVE-2026-13249 · MITRE
Track software like this
Free during beta