CVE-2026-4272: - Bluetooth Remote Execution of System Commands Vulnerability
Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAABK000765BAACU000101BAA.
This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Honeywell Handheld Scanners (C1 Base - Ingenic x1000)to a version that resolves this vulnerability.Fixed in GK000432BAA - Upgrade
Upgrade
Honeywell Handheld Scanners (D1 Base - Ingenic x1600)to a version that resolves this vulnerability.Fixed in HE000085BAA - Upgrade
Upgrade
Honeywell Handheld Scanners (A1/B1 Base - IMX25)to a version that resolves this vulnerability.Fixed in BK000763BAA_BK000765BAA_CU000101BAA - Compensating control
Restrict access to the Bluetooth base station so that remote attackers are not within Bluetooth range of the scanner's base station.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4272?
CVE-2026-4272 is classified as a critical vulnerability that allows remote execution of system commands without proper authentication.
How do I fix CVE-2026-4272?
To remediate CVE-2026-4272, upgrade your Honeywell Handheld Scanners to the latest firmware versions indicated in the vendor's security advisory.
Which devices are affected by CVE-2026-4272?
CVE-2026-4272 impacts Honeywell Handheld Scanners C1 Base (Ingenic x1000), D1 Base (Ingenic x1600), and A1/B1 Base (IMX25) before specified versions.
What type of vulnerability is CVE-2026-4272?
CVE-2026-4272 is a Missing Authentication for Critical Function vulnerability that allows unauthorized actions through Bluetooth.
Can CVE-2026-4272 be exploited remotely?
Yes, CVE-2026-4272 can be exploited remotely by attackers via Bluetooth to execute system commands.