CVE-2026-1670 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). ❌ **Flaw**: API endpoints lack proper validation. The system trusts requests without verifying the user's identity or permissions.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Exploitation Threshold**: **LOW**. 🔓 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 👤 **User Interaction**: None (UI:N). ⚡ **Complexity**: Low (AC:L). Easy to exploit!

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exploit**: **No**. 📝 **Status**: `pocs` array is empty. No public PoC or wild exploitation code found yet. However, the low barrier makes it highly likely to be weaponized soon.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. 📅 **Published**: 2026-02-17. 🔗 **Reference**: CISA ICSA-26-048-04 advisory. Honeywell support contact is available for patches. Check the official CSAF file for updates.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. ⚠️ **Priority**: **P1**. With a CVSS of 9.1 and no auth required, this is an immediate threat. Patch immediately or isolate from the network to prevent account takeover.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Access Control Error (CWE-306) in Honeywell products. <br>🔥 **Consequences**: Attackers can remotely change password reset email addresses via unverified API endpoints.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). <br>❌ **Flaw**: API endpoints lack proper validation. The system trusts requests without verifying the user's identity or permissions.

Q3Who is affected? (Versions/Components)

🏢 **Affected Vendor**: **Honeywell**. <br>📦 **Products**: <br>- I-HIB2PI-UL 2MP IP (Infrared Bullet Camera) <br>- SMB NDAA MVO-3 (Infrared PTZ Camera) <br>- PTZ WDR 2MP 32M (Night Vision Series) <br>*(Note: List may be p…

Read full answer (login)

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: <br>- **Privileges**: Remote, No Auth Required. <br>- **Data Impact**: High. Can hijack account recovery by changing the reset email.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Exploitation Threshold**: **LOW**. <br>🔓 **Auth**: None required (PR:N). <br>🌐 **Network**: Remote (AV:N). <br>👤 **User Interaction**: None (UI:N). <br>⚡ **Complexity**: Low (AC:L). Easy to exploit!

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exploit**: **No**. <br>📝 **Status**: `pocs` array is empty. No public PoC or wild exploitation code found yet. However, the low barrier makes it highly likely to be weaponized soon.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: <br>1. Scan for Honeywell I-HIB2PI-UL, SMB NDAA MVO-3, and PTZ WDR models. <br>2. Check for exposed API endpoints related to password reset. <br>3.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. <br>📅 **Published**: 2026-02-17. <br>🔗 **Reference**: CISA ICSA-26-048-04 advisory. Honeywell support contact is available for patches. Check the official CSAF file for updates.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Network Segmentation**: Isolate cameras from public internet. <br>2. **WAF Rules**: Block unauthorized access to password reset API endpoints. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>⚠️ **Priority**: **P1**. <br>With a CVSS of 9.1 and no auth required, this is an immediate threat. Patch immediately or isolate from the network to prevent account takeover.

Continue exploring

Vulnerability detail Full AI analysis (login) Honeywell CWE-306