Honeywell Control Network Module (CNM) has a flaw that allows insertion of sensitive information into an unintended directory. This improper handling of data can lead to confidentiality loss, as attackers may gain access to protected information. The weakness corresponds to CWE‑538, indicating that data is stored in a location that is not properly protected or segregated.

The affected product is Honeywell International Inc.’s Control Network Module (CNM). No specific version information is provided in the advisory. Administrators should identify systems running CNM and ascertain whether the package is the latest available version.

The CVSS score of 5.9 reflects moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no widespread exploitation to date. The likely attack vector is probing of system files to locate where sensitive data has been inadvertently stored; this inference is based on the description that an attacker could exploit the weakness through probing system files. The absence of documented exploitation suggests the likelihood is uncertain, but the potential impact warrants proactive remediation.