by Kastro
Paper/Archive/CVE-2026-1670

CVE-2026-1670

Honeywell I-HIB2PI-UL 2MP IP — Honeywell CCTV Products Missing Authentication for Critical Function

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.8.578 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

Affected

ProductAffectedFixed inSource
I-HIB2PI-UL 2MP IP6.1.22.1216–CNA
SMB NDAA MVO-3WDR_2MP_32M_PTZ_v2.0–CNA
PTZ WDR 2MP 32MWDR_2MP_32M_PTZ_v2.0–CNA
25M IPCWDR_2MP_32M_PTZ_v2.0–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-048-04refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.jsonrefhoneywell.com/us/en/contact/support