CVE-2026-1670CWE-306

Honeywell CCTV Products Missing Authentication for Critical Function

Critical · published February 17, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00837 · 57.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-17T22:56Z
EPSS history
Timeline
  • 17 FEB 22:56Z
    Honeywell CCTV Products Missing Authentication for Critical Function
    cvelistv5