CVE-2026-1670: Honeywell CCTV Products Missing Authentication for Critical Function
Published Feb 17, 2026
·Updated
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
Remediation
Information
Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information.
Event History
Feb 17, 2026
CVE Published
via MITRE·10:56 PM
Data Sourced
via MITRE·10:56 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Feb 18, 2026
News Published
via BleepingComputer·08:58 PM
News Published
via BleepingComputer·09:00 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-1670?
CVE-2026-1670 has a critical severity rating of 9.8.
2
How do I fix CVE-2026-1670?
Honeywell recommends contacting their support for patch information regarding CVE-2026-1670.
3
What can attackers do with CVE-2026-1670?
Attackers can exploit CVE-2026-1670 to remotely change the 'forgot password' recovery email address through an unauthenticated API.
4
Which products are affected by CVE-2026-1670?
CVE-2026-1670 affects Honeywell CCTV products that have an unauthenticated API endpoint.
5
When was CVE-2026-1670 published?
CVE-2026-1670 was published on February 17, 2026.