Exposed: Security Vulnerability in Honeywell CCTVs Allows Unauthorized Access

Critical Vulnerability Found in Honeywell CCTVs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical security flaw in several Honeywell CCTV products. This vulnerability could potentially lead to unauthorized access to camera feeds or account hijacking.

Discovered by researcher Souvik Kanda and identified as CVE-2026-1670, this security issue is categorized as “missing authentication for critical function” and has been given a severity score of 9.8, indicating its critical nature.

The vulnerability allows an unauthenticated attacker to manipulate the recovery email address associated with a device account, ultimately granting them access to camera feeds without authorization.

CISA has stated, “The affected product is vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the ‘forgot password’ recovery email address.”

According to the security advisory, the following models are impacted by CVE-2026-1670:

• I-HIB2PI-UL 2MP IP 6.1.22.1216
• SMB NDAA MVO-3 WDR_2MP_32M_PTZ_v2.0
• PTZ WDR 2MP 32M WDR_2MP_32M_PTZ_v2.0
• 25M IPC WDR_2MP_32M_PTZ_v2.0

Honeywell is a leading global provider of security and video surveillance equipment, offering a wide range of CCTV camera models and related products utilized in commercial, industrial, and critical infrastructure environments worldwide.

The company offers several NDAA-compliant cameras suitable for deployment in U.S. government agencies and federal contractors.

The specific model families mentioned in CISA’s advisory are mid-level video surveillance products commonly used in small to medium business settings, offices, warehouses, and potentially critical facilities.

As of February 17th, there have been no reported instances of public exploitation targeting this vulnerability. However, CISA recommends minimizing network exposure of control system devices by isolating them behind firewalls and utilizing secure remote access methods, such as updated VPN solutions, when necessary for remote connectivity.

Although Honeywell has not released an advisory on CVE-2026-1670, users are encouraged to reach out to the company’s support team for guidance on patching the vulnerability.

Modern IT infrastructure outpaces manual workflows. Learn how to reduce delays, enhance reliability with automated responses, and create intelligent workflows using familiar tools in the new Tines guide.

Get the guide