CVE-2026-1670

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1670", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-01-30T00:35:22.440Z", "datePublished": "2026-02-17T22:56:00.586Z", "dateUpdated": "2026-02-18T20:45:46.226Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "I-HIB2PI-UL 2MP IP", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "6.1.22.1216"}]}, {"defaultStatus": "unaffected", "product": "SMB NDAA MVO-3", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}, {"defaultStatus": "unaffected", "product": "PTZ WDR 2MP 32M", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}, {"defaultStatus": "unaffected", "product": "25M IPC", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Souvik Kandar reported this vulnerability to CISA."}], "datePublic": "2026-02-17T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."}], "value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-17T22:56:00.586Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json"}, {"url": "https://www.honeywell.com/us/en/contact/support"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Honeywell recommends users contact Honeywell at <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.honeywell.com/us/en/contact/support\">https://www.honeywell.com/us/en/contact/support</a> for patch information.<br>"}], "value": "Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information."}], "source": {"advisory": "ICSA-26-048-04", "discovery": "EXTERNAL"}, "title": "Honeywell CCTV Products Missing Authentication for Critical Function", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T20:45:37.144272Z", "id": "CVE-2026-1670", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:45:46.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1670", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T20:45:37.144272Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:45:43.286Z"}}], "cna": {"title": "Honeywell CCTV Products Missing Authentication for Critical Function", "source": {"advisory": "ICSA-26-048-04", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Souvik Kandar reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Honeywell", "product": "I-HIB2PI-UL 2MP IP", "versions": [{"status": "affected", "version": "6.1.22.1216"}], "defaultStatus": "unaffected"}, {"vendor": "Honeywell", "product": "SMB NDAA MVO-3", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}], "defaultStatus": "unaffected"}, {"vendor": "Honeywell", "product": "PTZ WDR 2MP 32M", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}], "defaultStatus": "unaffected"}, {"vendor": "Honeywell", "product": "25M IPC", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information.", "supportingMedia": [{"type": "text/html", "value": "Honeywell recommends users contact Honeywell at <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.honeywell.com/us/en/contact/support\">https://www.honeywell.com/us/en/contact/support</a> for patch information.<br>", "base64": false}]}], "datePublic": "2026-02-17T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json"}, {"url": "https://www.honeywell.com/us/en/contact/support"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address.", "supportingMedia": [{"type": "text/html", "value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-17T22:56:00.586Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1670", "state": "PUBLISHED", "dateUpdated": "2026-02-18T20:45:46.226Z", "dateReserved": "2026-01-30T00:35:22.440Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-17T22:56:00.586Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "I-HIB2PI-UL 2MP IP", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "6.1.22.1216"}]}, {"defaultStatus": "unaffected", "product": "SMB NDAA MVO-3", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}, {"defaultStatus": "unaffected", "product": "PTZ WDR 2MP 32M", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}, {"defaultStatus": "unaffected", "product": "25M IPC", "vendor": "Honeywell", "versions": [{"status": "affected", "version": "WDR_2MP_32M_PTZ_v2.0"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."}, {"lang": "es", "value": "Los productos afectados son vulnerables a una exposici\u00f3n de endpoint de API no autenticado, lo que podr\u00eda permitir a un atacante cambiar en remoto la direcci\u00f3n de correo electr\u00f3nico de recuperaci\u00f3n de 'olvid\u00e9 mi contrase\u00f1a'."}], "id": "CVE-2026-1670", "lastModified": "2026-06-17T10:16:17.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1670", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T20:45:37.144272Z", "version": "2.0.3"}}]}, "published": "2026-02-17T23:16:19.480", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.honeywell.com/us/en/contact/support"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "WDR_2MP_32M_PTZ_v2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "25M IPC", "source": "cna", "vendor": "Honeywell"}, "product": "25m_ipc", "vendor": "honeywell"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1.22.1216"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "I-HIB2PI-UL 2MP IP", "source": "cna", "vendor": "Honeywell"}, "product": "i-hib2pi-ul_2mp_ip", "vendor": "honeywell"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "WDR_2MP_32M_PTZ_v2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PTZ WDR 2MP 32M", "source": "cna", "vendor": "Honeywell"}, "product": "ptz_wdr_2mp_32m", "vendor": "honeywell"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "WDR_2MP_32M_PTZ_v2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SMB NDAA MVO-3", "source": "cna", "vendor": "Honeywell"}, "product": "smb_ndaa_mvo-3", "vendor": "honeywell"}], "analysis": {"en": {"generated_at": "2026-04-17T18:50:03.206013+00:00", "value": {"mitigation_remediation": ["Contact Honeywell support for patch information and apply the vendor\u2019s fix as soon as it is available.", "Restrict network access to the affected cameras and controllers by implementing firewall rules or placing the devices behind a VPN to limit exposure to the vulnerable API endpoint.", "Document and monitor any account\u2011reset events to detect possible unauthorized recovery\u2011email changes in the interim."], "summary": {"action": "Patch Immediately", "impact": "Potential unauthorized password reset via email change"}, "threat_synthesis": {"affected_systems": "Affected Honeywell CCTV cameras and controllers include the 25\u202fM\u202fIPC series, the I\u2011HIB2PI\u2011UL 2MP IP unit, the PTZ\u202fWDR 2MP\u202f32M camera, and the SMB\u202fNDAA\u202fMVO\u20113. Specific revision or firmware numbers are not listed in the CNA data, so the impact applies to all currently installed units of these product lines lacking the fix.", "description_and_impact": "The vulnerability allows unauthenticated modification of the recovery email address through a public API endpoint, enabling an attacker to tamper with credential recovery procedures. This weakness corresponds to an authentication failure where no credentials are required to alter account\u2011related data.", "risk_and_exploitability": "The CVSS score of 9.3 denotes a high\u2011severity flaw. The EPSS score of less than 1\u202f% indicates that, at the time of analysis, the probability of public exploitation is low, yet the flaw remains a high\u2011value target because it requires no special privileges and can be carried out by any network actor that can reach the device. It is not yet listed in the CISA KEV catalog. Based on the description it is inferred that the vulnerable API endpoint is accessible over the network without authentication, which allows attackers to remotely alter recovery information and potentially hijack user accounts."}}}}, "created": "2026-02-18T10:33:04.478821+00:00", "updated": "2026-04-17T19:00:11.025942+00:00", "vendors": ["honeywell", "honeywell$PRODUCT$25m_ipc", "honeywell$PRODUCT$i-hib2pi-ul_2mp_ip", "honeywell$PRODUCT$ptz_wdr_2mp_32m", "honeywell$PRODUCT$smb_ndaa_mvo-3"]}