CVE-2026-1670

CVE-2026-1670 describes a critical vulnerability affecting Honeywell HIB2PI and HDZ Series CCTV cameras, stemming from an unauthenticated API endpoint exposure. This flaw allows an attacker to remotely alter the "forgot password" recovery email address, potentially leading to full account compromise. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not yet listed in CISA's KEV catalog and lacking public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community attention with 23 mentions and 3 media articles, indicating a high level of awareness and potential for future exploitation.