CISA Warns: Honeywell CCTV Flaw Enables Remote Account Takeover

CISA issued advisory ICSA-26-048-04 on February 17, 2026, warning of critical CVE-2026-1670 affecting Honeywell CCTV cameras. The authentication bypass (CVSS 9.8) lets unauthenticated attackers change password recovery email addresses remotely. Attackers gain admin access to live camera feeds after reset.

Security researcher Souvik Kandar discovered the missing authentication on a critical API endpoint. No login required to modify recovery email. Full account takeover follows via password reset to attacker-controlled email.

Devices deployed worldwide in commercial facilities, critical infrastructure. No public exploits reported yet. Immediate mitigation essential due to trivial remote exploitation.

Vulnerability Details

Unauthenticated API endpoint exposes password recovery function. Attackers POST new email address directly. Legitimate reset emails route to attacker inbox.

Attack sequence:

1. Discover exposed Honeywell camera IP
2. POST /api/recovery-email with attacker email
3. Trigger password reset via changed email
4. Login with new credentials
5. Full admin access to video feeds

Compromised cameras serve as network pivots. Attackers gain physical security visibility for further operations.

Affected Products List

Product Name	Affected Version
I-HIB2PI-UL 2MP IP	6.1.22.1216
SMB NDAA MVO-3	WDR_2MP_32M_PTZ_v2.0
PTZ WDR 2MP 32M	WDR_2MP_32M_PTZ_v2.0
25M IPC	WDR_2MP_32M_PTZ_v2.0

Multiple IP and PTZ camera families vulnerable. Commercial facilities sector primary deployment.

Technical Impact Scope

Consequence	Risk Level	Description
Account Takeover	Critical	Admin credentials compromised
Video Feed Access	Critical	Live surveillance exposed
Network Pivot	High	Internal network reconnaissance
Physical Security	High	Facility layout mapping
Lateral Movement	Medium	VPN/remote access abuse

CVSS breakdown: Attack Vector Network, no privileges/user interaction required.

CISA Mitigation Guidance

Network segmentation:

• Isolate control systems behind firewalls
• Block direct Internet access to cameras
• Separate OT from IT networks

Remote access:

• Deploy updated VPN solutions only
• Secure jump servers with MFA
• Monitor VPN logs for anomalies

Immediate actions:

• Scan perimeter for exposed cameras
• Change all recovery email addresses
• Implement network access controls

Honeywell patch status unavailable. Contact vendor support directly.

Exposure Assessment

Discovery risk:

textShodan: "Honeywell" port:80/443
Censys: "Server: Honeywell" country:US/EU

Internet-facing cameras:

• Corporate headquarters
• Retail chains
• Manufacturing plants
• Government facilities
• Data centers

Physical security compromise enables targeted social engineering attacks.

Detection Indicators

Network traffic:

textPOST /api/recovery-email 200 OK
User-Agent: non-browser patterns
Recovery email changes without admin login

Log anomalies:

textPassword reset emails to unknown domains
Failed logins post-email change
Unusual geolocation for admin access

Vendor Response Status

CISA timeline:

• Discovery: Souvik Kandar
• Published: February 17, 2026
• Exploitation: None reported
• Patch: Honeywell support contact required

No public vendor advisory. Organizations must reach technical support directly.

Risk Prioritization Matrix

Exposure	Urgency	Action
Internet-facing	Critical	Isolate immediately
VPN accessible	High	MFA + network controls
Internal only	Medium	Monitor + vendor contact
Air-gapped	Low	Routine patching

ICS Best Practices Reference

CISA recommendations:

texthttps://www.cisa.gov/uscert/ics
Isolate control systems
Minimize Internet exposure
Secure remote access
Vendor patch coordination

FAQ