An authenticated attacker with the admin or itadmin account can submit Intermec Fingerprint programming language commands directly to the printer’s internal interpreter, resulting in arbitrary file writes and execution of malicious files and commands. The weakness stems from insufficient validation of user input and path handling, which maps to CWE-434 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-73 (Absolute Path Traversal), and CWE-78 (Improper Neutralization of Special Elements used in a Command). Consequently, a compromised user can gain full control of the printer’s firmware environment and run arbitrary commands that may affect confidentiality, integrity, and availability.

The vulnerability affects Honeywell PD45 Industrial Printers running firmware version F10.19.010040. Honeywell recommends upgrading to firmware F10.22.030745, which includes the fix for this flaw.

The CVSS score is 8.8, indicating high severity. The vulnerability is not listed in CISA KEV and does not have an EPSS score available, suggesting an undefined but potentially low to moderate exploitation probability. Because the flaw requires authenticated access to the admin or itadmin accounts, the attack vector is limited to devices on a network where such credentials are available. Nevertheless, once accessed, the attacker can achieve complete command execution, representing a serious risk for any connected production environment.