CVE-2026-1670 PUBLISHED

Honeywell CCTV Products Missing Authentication for Critical Function

Assigner: icscert
Reserved: 30.01.2026 Published: 17.02.2026 Updated: 17.02.2026

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Honeywell
Product I-HIB2PI-UL 2MP IP
Versions Default: unaffected
  • Version 6.1.22.1216 is affected
Vendor Honeywell
Product SMB NDAA MVO-3
Versions Default: unaffected
  • Version WDR_2MP_32M_PTZ_v2.0 is affected
Vendor Honeywell
Product PTZ WDR 2MP 32M
Versions Default: unaffected
  • Version WDR_2MP_32M_PTZ_v2.0 is affected
Vendor Honeywell
Product 25M IPC
Versions Default: unaffected
  • Version WDR_2MP_32M_PTZ_v2.0 is affected

Solutions

Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information.

Credits

  • Souvik Kandar reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-306 Missing Authentication for Critical Function CWE