The Honeywell Control Network Module (CNM) contains a command injection vulnerability (CWE-77) in its web interface. This vulnerability allows an attacker to inject commands via command delimiters, potentially leading to remote code execution (RCE). The affected versions are 100.1, 101.1, 110.1, and 110.2. Honeywell advises upgrading to version 200.1 or later to address this issue. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch link is provided, but the vendor's recommendation to update to version 200.1 constitutes the remediation guidance.

Successful exploitation could allow an attacker with high privileges to execute arbitrary commands remotely on the affected CNM devices, leading to full compromise of confidentiality, integrity, and availability of the system. This could disrupt control network operations and potentially impact critical infrastructure managed by Honeywell CNM devices.

Honeywell recommends updating affected CNM devices to the most recent version 200.1 or later. This update addresses the command injection vulnerability. No other mitigation or temporary fixes are provided. Patch status is not explicitly confirmed beyond the vendor's recommendation to update; users should verify with Honeywell for the latest advisory and patch availability.