Honeywell S35 Cameras CVE-2025-12351

Exploitation requires the attacker to already possess a valid low-privileged user account on the S35 camera (PR:L) and to manipulate a user-controlled identifier key that the device trusts for authorization (CWE-639 IDOR). Limiting factors: authentication is mandatory - this is NOT anonymous/unauthenticated access; the vendor rates attack complexity HIGH (AC:H), implying the manipulation is not trivially reliable; and exposure depends on the camera's management interface being reachable by the attacker (network vector, but typically on an internal/VLAN segment rather than the public internet). Patched firmware (model-specific 2025.08.xx versions) removes the condition.

This is a moderate-priority vulnerability that does not rise to an emergency despite a HIGH confidentiality/integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, base 6.8) describes a network-reachable but authenticated (PR:L) flaw requiring an attacker to already hold a low-privileged camera account, with high attack complexity (AC:H). All exploitation signals point AWAY from widespread active abuse: EPSS is only 0.23% (13th percentile), the CVE is NOT on the CISA KEV list, and no public POC was identified in the supplied data. Exploitation status is therefore 'no public exploit identified at time of analysis.' The CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. IDOR) classification is the one factor that elevates concern - IDOR flaws are often simpler to exploit than the vendor's AC:H rating implies, which is a conflict worth flagging: the technical mechanism (manipulating a user-controlled key) suggests LOW complexity, yet the vendor assigned AC:H. The practical gate is the PR:L requirement: an attacker needs valid low-level credentials, so the realistic threat is a malicious or compromised non-admin user escalating to admin, not anonymous internet-wide attack. Net assessment: genuine privilege-escalation risk for environments exposing these cameras to semi-trusted users, but low likelihood of mass exploitation.

An attacker who already holds a low-privileged account on a Honeywell S35 camera (or who has phished/guessed such credentials) sends a request manipulating the user-controlled key that identifies the acting user, causing the camera to treat the request as an administrator. No public exploit code is known, and the vendor-rated high attack complexity suggests some non-trivial conditioning of the request is required.