CVE-2026-13248— Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
Quick assessment
Affected
Honeywell PD45 Industrial Printer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Honeywell PD45 工业打印机（版本 F10.19.010040）的 Web 管理界面中存在一个与 Intermec Fingerprint 命令接口相关的任意文件写入漏洞，可导致远程代码执行。该漏洞允许经过身份认证且具有 admin 或 itadmin 账户权限的用户，将使用 Intermec Fingerprint 编程语言编写的命令直接提交给打印机的内部命令解释器。 攻击者可能利用此漏洞执行恶意文件和命令。Honeywell 建议将固件更新至最新版本 Honeywell PD45 工业打印机固件 F
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
Source: CVE Program / CVE List V5
Vulnerability Description
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Honeywell | PD45 Industrial Printer | F10.19.010040 ~ F10.22.030745 | - |
|
II. Public POCs for CVE-2026-13248
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13248
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13248 (1)
IV. Related Vulnerabilities
Same vendor: Honeywell
-
CVE-2026-13249
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Ind -
CVE-2026-17612
Audit Log Exposure through Unauthorized Access -
CVE-2026-4272
CVE-2026-4272 - Bluetooth Remote Execution of System Command -
CVE-2026-3611
Honeywell IQ4x BMS Controller Missing authentication for cri -
CVE-2026-1670
Honeywell CCTV Products Missing Authentication for Critical
Same weakness: CWE-73
-
CVE-2026-100638
SiYuan before v3.8.4 Path Traversal via setNotebookIcon -
CVE-2026-100637
SiYuan before v3.8.4 Path Traversal via checkoutRepo session -
CVE-2026-96656
Plex Media Server arbitrary file write -
CVE-2026-92164
Streamlink: HTTPSession follows HTTP redirects into file:// -
CVE-2026-91797
Foxit PDF Editor/Reader Portfolio Directory Traversal Remote
V. Comments for CVE-2026-13248
No comments yet