Honeywell CVE-2026-4272

Attacker must be within Bluetooth range of Honeywell Handheld Scanner base station (C1/D1/A1/B1 models before specified firmware versions). Victim interaction required: user must initiate pairing or connection. Remote command execution on host computer connected to base station without authentication.

Real-world risk is elevated but constrained by attack prerequisites. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible attack with low complexity and no privileges required, but user interaction is necessary, likely referring to the host system actively communicating with the scanner base. The Bluetooth attack vector imposes physical proximity requirements (within radio range), limiting this to localized attacks rather than internet-wide exploitation. High confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N) suggests attackers can exfiltrate data and modify system state but not cause denial of service. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not being widely exploited. Primary risk exists in industrial, warehouse, and retail environments where these scanners operate in proximity to unauthorized personnel. The authentication bypass combined with command execution capabilities makes this a genuine priority for organizations using affected scanner models, particularly in security-sensitive environments where scanning infrastructure connects to critical business systems.

An attacker positions themselves within Bluetooth range of a retail store or warehouse using vulnerable Honeywell scanner base stations. Using commodity Bluetooth hardware and scanning tools, the attacker identifies active scanner base stations broadcasting without authentication requirements. When a legitimate user operates the scanner triggering communication between the base station and connected point-of-sale or inventory management host, the attacker sends malicious commands through the unauthenticated Bluetooth interface. The base station relays these commands to the connected host system where they execute with the privileges of the scanner interface service, potentially allowing the attacker to access sensitive transaction data, modify inventory records, or establish persistent access to the retail network infrastructure.