CVE-2023-3710: Printer web page invalid command execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 49.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-12 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

Affected products

Honeywell Pm43 Firmware: before p10.19.050004 — fixed in p10.19.050004

How to fix

Upgrade to a fixed version: Honeywell Pm43 Firmware p10.19.050004. Check the vendor advisory for mitigations.

References

https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
https://www.honeywell.com/us/en/product-security
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
https://www.honeywell.com/us/en/product-security

Get alerted when CVE-2023-3710 or the next vulnerability affects your stack