An unauthenticated vulnerability in the web management interface of Honeywell PD45 Industrial Printer allows an attacker to upload arbitrary files, which can then be executed as system commands. This flaw bypasses authentication checks, permits execution of malicious code, and gives the attacker full control over the device. The weakness is characterized by missing authentication, arbitrary file upload, and operating‑system command injection, as identified by CWE-306, CWE-434, and CWE-78.

Honeywell PD45 Industrial Printer, version F10.19.010040.

The CVSS score of 9.8 indicates critical severity, and the lack of an EPSS rating does not diminish the inherent risk posed by an unauthenticated vector. Because the flaw exists in the publicly reachable web interface, an attacker does not need any credentials or privileged access to exploit it. Once a file is uploaded, it can be executed with the privileges of the printer’s operating system, allowing full compromise of the device. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS rating and the available exploitation pathway mean it should be treated as a high‑risk event.