CRITICAL INFRA HONEYWELL CCTVS VULNERABLE TO AUTH BYPASS FLAW

Summary from the TLDR InfoSec newsletter

CISA warned of CVE-2026-1670 (CVSS 9.8), a missing authentication flaw in multiple Honeywell CCTV models that allows unauthenticated attackers to remotely change the password recovery email address, enabling full account takeover and unauthorized access to camera feeds. Affected models include the I-HIB2PI-UL and several SMB NDAA-compliant PTZ cameras deployed in commercial and critical infrastructure environments. Organizations should isolate these devices behind firewalls, restrict network exposure, and contact Honeywell for patch guidance.