CVE-2025-2605

The vulnerability results from improper neutralization of special characters in operating system commands (CWE-78 — OS Command Injection). An attacker with basic network authentication can inject malicious system commands that will be executed by the device with elevated privileges. The attack vector is network-based, requires no user interaction or high initial privileges, and the impact includes complete breach of confidentiality, integrity, and availability of the system and related systems.

An attacker can execute arbitrary operating system commands on the device, leading to complete system takeover, data leakage, configuration modification, or disruption of operations — with potential impact on other systems in the network.

Honeywell MB-Secure firmware must be updated to version V12.53 or later, and Honeywell MB-Secure PRO to version V03.09 or later. The manufacturer additionally recommends migration to the latest available product version. Details are available in Honeywell security notices at https://www.honeywell.com/us/en/product-security#security-notices.

Honeywell MB-Secure versions from V11.04 to V12.52 (before V12.53) and Honeywell MB-Secure PRO versions from V01.06 to V03.08 (before V03.09).