{"id":215073,"date":"2026-02-18T15:58:00","date_gmt":"2026-02-18T20:58:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/18\/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw\/"},"modified":"2026-02-18T19:20:13","modified_gmt":"2026-02-19T00:20:13","slug":"critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/18\/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw\/","title":{"rendered":"Critical infra Honeywell CCTVs vulnerable to auth bypass flaw"},"content":{"rendered":"

Critical infra Honeywell CCTVs vulnerable to auth bypass flaw<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw\/<\/a><\/p>\n

Publish Date: 2026-02-18 15:58:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a critical vulnerability in multiple Honeywell CCTV products that allows unauthorized access to feeds or account hijacking.<\/p>\n

Discovered by researcher Souvik Kanda and tracked as CVE-2026-1670, the security issue is classified as \u201cmissing authentication for critical function,\u201d and received a crtical severity score of 9.8.<\/p>\n

The flaw allows an unauthenticated attacker to change the recovery email address associated with a device account, enabling account takeover and unauthorized access to camera feeds.<\/p>\n

\"Wiz\"<\/p>\n

\u201cThe affected product is vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the “forgot password” recovery email address,\u201d CISA says.<\/p>\n

According to the security advisory, CVE-2026-1670 impacts the following models:<\/p>\n