CISA Warns of Critical Auth Bypass in Honeywell CCTV Cameras (CVE-2026-1670)

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a critical vulnerability affecting multiple Honeywell CCTV products. The flaw, tracked as CVE-2026-1670, carries a CVSS score of 9.8 and allows unauthenticated attackers to take over camera accounts.

The vulnerability poses significant risk to organizations relying on Honeywell surveillance systems for physical security and critical infrastructure monitoring.

Authentication Bypass via Exposed API

The issue stems from an exposed, unauthenticated API endpoint present in several mid-level Honeywell camera models. Exploiting this endpoint enables attackers to modify account settings without logging in.

Specifically, attackers can change the configured recovery email address, effectively locking out legitimate users and gaining full control of affected camera accounts.

Potential Impact

Successful exploitation could allow threat actors to:

• Hijack surveillance camera accounts
• Alter or disable monitoring feeds
• Access sensitive video footage
• Disrupt security operations

In environments such as industrial facilities, transportation hubs, or government buildings, compromised CCTV systems could undermine both physical and cybersecurity defenses.

Affected Products

The vulnerability impacts several mid-tier Honeywell CCTV camera models. While not all product lines are affected, organizations using internet-exposed or remotely accessible devices may be at heightened risk.

Mitigation Guidance

CISA recommends that organizations take immediate steps to reduce exposure, including:

• Minimizing direct internet exposure of CCTV systems
• Placing devices behind firewalls or VPN access controls
• Monitoring for unauthorized account configuration changes
• Contacting Honeywell support for patch or remediation guidance

Until official patches or mitigation instructions are applied, reducing network accessibility is critical to limiting attack surface.

Critical Infrastructure Concerns

Surveillance systems are often deployed in sensitive operational environments. A vulnerability with a 9.8 severity score and no authentication requirement significantly increases the risk of exploitation, particularly if proof-of-concept code becomes publicly available.

Organizations operating Honeywell CCTV systems are urged to prioritize assessment and remediation efforts without delay.