The vulnerability is an improper sanitization flaw that allows an attacker to inject arbitrary command delimiters through the CNM web interface, leading to Remote Code Execution. The weakness permits execution of malicious commands outside the intended context, potentially compromising system integrity and confidentiality.

Honeywell Control Network Module is affected. The specific product name is Control Network Module (CNM) from Honeywell International Inc. Version information is not disclosed, indicating that the flaw may exist across multiple or all current releases.

The CVSS score of 9.1 indicates critical severity, and the EPSS score of 0.0026 indicates a very low exploitation probability, but the risk remains significant. The vulnerability is exploitable remotely via the web interface; the description does not specify an authentication requirement, so it is inferred that the web interface may be accessible without specific credentials or that authentication may not mitigate the flaw. Based on the description, the likely attack vector is through command delimiters injected via the web interface. The absence of a KEV listing does not reduce its threat, as the nature of RCE enables a wide range of malicious outcomes.