What is the CVSS score of CVE-2026-4272?

CVE-2026-4272 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Honeywell are affected by CVE-2026-4272?

Honeywell handheld scanner base stations (C1, D1, A1, B1 models) contain a remote command execution vulnerability allowing unauthenticated attackers within Bluetooth range to compromise connected…

How to fix or mitigate CVE-2026-4272?

Within 24 hours: Identify all Honeywell C1/D1/A1/B1 base station models in your environment and document their current firmware versions (verify against GK000432BAA, HE000085BAA, BK000763BAA, BK000765BAA, CU000101BAA). Within 7 days: Disable Bluetooth functionality on affected base stations where operationally feasible; segregate affected devices to isolated network segments with restricted outbound access; implement Bluetooth range monitoring to detect unauthorized proximity. Within 30 days: Contact Honeywell Support to confirm patch availability timeline; develop a phased replacement or firmware update strategy once vendor patches become available; evaluate alternative scanning solutions for critical operations.

Honeywell CVE-2026-4272

EUVD-2026-19128 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-04-05 psirt@honeywell.com

Honeywell Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 05, 2026 - 22:22 euvd

EUVD-2026-19128

Analysis Generated

Apr 05, 2026 - 22:22 vuln.today

CVE Published

Apr 05, 2026 - 22:16 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.

This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.

AnalysisAI

Remote unauthenticated command execution in Honeywell Handheld Scanner base stations (C1/D1/A1/B1 models) allows attackers within Bluetooth range to execute system commands on connected host systems without authentication. Affects C1 Base (Ingenic x1000) before GK000432BAA, D1 Base (Ingenic x1600) before HE000085BAA, and A1/B1 Base (IMX25) before BK000763BAA/BK000765BAA/CU000101BAA. CVSS 8.1 (High) reflects high confidentiality and integrity impact with network attack vector requiring user interaction. No public exploit identified at time of analysis, though the missing authentication (CWE-306) combined with proximity-based Bluetooth attack vector creates significant risk for environments using these industrial scanning devices.

Technical ContextAI

This vulnerability stems from missing authentication for critical functions (CWE-306) in the Bluetooth communication protocol between Honeywell handheld scanner base stations and connected host systems. The affected base stations use various embedded processors: C1 models use Ingenic x1000 SoCs, D1 models use Ingenic x1600 SoCs, and A1/B1 models use Freescale i.MX25 processors. The absence of authentication controls on critical command execution interfaces allows the base station to accept and relay system commands from unauthorized Bluetooth-capable devices within radio range (typically 10-100 meters depending on Bluetooth class). The vulnerability exploits the trust relationship between the scanner base and the connected host system, enabling attackers to leverage the base station as a command relay without presenting valid credentials.

RemediationAI

Honeywell has released patched firmware versions addressing this authentication bypass vulnerability. Organizations should immediately upgrade C1 Base scanners to firmware version GK000432BAA or later, D1 Base scanners to HE000085BAA or later, and A1/B1 Base scanners to BK000763BAA, BK000765BAA, or CU000101BAA as appropriate for their specific model. Firmware updates should be obtained through authorized Honeywell support channels or partner distributors. Until patches can be deployed, organizations should implement compensating controls including physically securing scanner base stations in controlled-access areas to limit Bluetooth proximity attacks, disabling Bluetooth functionality if alternative connectivity options exist, monitoring host systems connected to scanner bases for unauthorized command execution, and restricting base station deployments to isolated network segments where command execution cannot reach critical systems. Consult Honeywell PSIRT advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-4272 for additional vendor-specific guidance and firmware acquisition procedures.