The US Cybersecurity and Infrastructure Agency (CISA) has issued a serious warning regarding a critical vulnerability discovered in multiple Honeywell CCTV models, affecting both home and business users. This flaw allows unauthorized attackers to gain access to live feeds and potentially hijack device accounts, raising significant concerns for security and privacy.
The vulnerability, identified by cybersecurity researcher Souvik Kanda and tracked under CVE-2026-1670, has been classified as “missing authentication for critical function” and carries a critical severity score of 9.8. According to CISA, the flaw allows attackers to exploit an unauthenticated API endpoint to change the “forgot password” recovery email address associated with a CCTV device account. This manipulation provides the attacker with full access to the device, enabling live feed monitoring and total account control.
Affected Honeywell CCTV models include the I-HIB2PI-UL 2MP IP 6.1.22.1216, SMB NDAA MVO-3 WDR 2MP PTZ, PTZ WDR 2MP 32M, and 25M IPC WDR 2MP 32M PTZ models. These devices are typically deployed in small to medium businesses, offices, warehouses, and other commercial settings. Honeywell is widely known as a global supplier of video surveillance and security devices, and several of its products comply with the National Defense Authorization Act (NDAA), making them suitable for use by United States government agencies and federal contractors.
CISA has recommended that users minimize network exposure for affected devices. Placing CCTV systems behind firewalls and restricting internet access can reduce the likelihood of exploitation. Remote access should be conducted through secure methods such as Virtual Private Networks (VPNs). Until Honeywell releases an official patch to resolve the vulnerability, these precautions are essential for mitigating risk.
While Honeywell has not yet released an official patch note or security update for the affected models, users are urged to contact the company’s support team for guidance on securing devices. Cybersecurity experts also recommend updating device firmware where possible, changing passwords, and monitoring accounts for any unusual activity.
The incident highlights the increasing importance of cybersecurity for connected devices, especially those handling sensitive video surveillance data. Vulnerabilities like CVE-2026-1670 demonstrate how hackers can exploit weak authentication protocols to gain access to private or corporate environments, emphasizing the need for proactive security measures.
For users relying on Honeywell CCTV for home, office, or commercial security, immediate attention to network configuration and access controls is crucial. This alert from CISA serves as a reminder that even widely trusted and globally deployed devices can have exploitable vulnerabilities, and continuous vigilance is necessary to maintain the integrity and safety of surveillance systems.
