Quick Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical vulnerability in Honeywell CCTV products, tracked as CVE-2026-1670. This flaw, which has a severity score of 9.8, allows unauthorized access to camera feeds and account hijacking by enabling attackers to change recovery email addresses. The affected models include I-HIB2PI-UL 2MP IP and SMB NDAA MVO-3, among others, and as of February 17, 2026, there have been no known public exploitations of this vulnerability.
The Securityish Brief
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted users to a critical vulnerability in multiple Honeywell CCTV products, identified as CVE-2026-1670. Discovered by researcher Souvik Kanda, this security issue is classified as ‘missing authentication for critical function’ and has received a critical severity score of 9.8. The vulnerability allows unauthenticated attackers to change the recovery email address associated with device accounts, leading to potential account takeover and unauthorized access to camera feeds.
The specific models affected include the I-HIB2PI-UL 2MP IP 6.1.22.1216, SMB NDAA MVO-3 WDR_2MP_32M_PTZ_v2.0, PTZ WDR 2MP 32M WDR_2MP_32M_PTZ_v2.0, and 25M IPC WDR_2MP_32M_PTZ_v2.0. These products are primarily used in small to medium business environments, including offices and warehouses, some of which may be critical infrastructure.
As of February 17, 2026, CISA reported no known public exploitation of this vulnerability. However, the agency recommends minimizing network exposure of control system devices and isolating them behind firewalls. Secure remote access methods, such as updated VPN solutions, should be employed when remote connectivity is necessary.
Understanding the Risks
This vulnerability highlights the ongoing risks associated with IoT devices, particularly in critical infrastructure settings. Unauthorized access to surveillance feeds can lead to significant security breaches, compromising the safety of facilities and sensitive information.
Organizations using Honeywell CCTV products should take immediate action to assess their network configurations and implement recommended security measures. Regular monitoring of device settings and prompt updates to firmware can help mitigate potential risks.
It is essential for users to remain vigilant and proactive in managing their security systems, especially when vulnerabilities like CVE-2026-1670 are identified. Engaging with Honeywell’s support team for guidance on patches and updates is advisable to ensure continued protection.
Key Takeaways
- Review the security settings of Honeywell CCTV products to ensure they are properly configured.
- Contact Honeywell’s support team for guidance on patching the CVE-2026-1670 vulnerability.
- Implement firewalls to isolate control system devices from direct internet access.
- Use secure remote access methods, such as updated VPN solutions, when accessing CCTV feeds remotely.
- Regularly monitor device accounts for any unauthorized changes or suspicious activity.
Key Terms & Concepts
- CVE-2026-1670: In this article, CVE-2026-1670 refers to a critical vulnerability in Honeywell CCTV products that allows unauthorized access.
- unauthenticated access: Unauthenticated access refers to the ability to access a system or device without proper credentials or verification.
- account takeover: Account takeover is when an unauthorized person gains control of a user’s account, often leading to data breaches.
Read the original article here: https://www.bleepingcomputer.com/news/security/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
