CVE-2026-4272

CVE-2026-4272 is a Missing Authentication vulnerability affecting multiple Honeywell Handheld Scanner models across three hardware platforms (C1 Base with Ingenic x1000, D1 Base with Ingenic x1600, and A1/B1 Base with IMX25). The vulnerability permits remote attackers within Bluetooth range to execute arbitrary system commands on host systems connected to the scanner's base station without any authentication requirement. The vulnerability carries a High severity rating with a CVSS score of 8.1, reflecting a network-based attack vector with low complexity and no privilege or user interaction requirements. The attack can result in high confidentiality and integrity impacts, though availability is not affected. The wide accessibility of the attack surface combined with the complete lack of authentication controls makes this a significant security concern for affected organizations. Current exploitation status indicates this vulnerability is not actively being exploited in the wild, with an EPSS score of 0.0004 reflecting minimal probability of active exploitation. No publicly available exploit code appears to be circulating, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. Honeywell has released patches for all affected product lines and strongly recommends immediate upgrades to the specified fixed versions.