Cyber Posture

CVE-2026-4272

High

Published: 05 April 2026

Published
05 April 2026
Modified
07 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS Score 0.0003 9.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Security Summary

CVE-2026-4272 is a Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners, enabling Authentication Abuse. It affects specific versions of the scanner base stations: C1 Base (Ingenic x1000) prior to GK000432BAA, D1 Base (Ingenic x1600) prior to HE000085BAA, and A1/B1 Base (IMX25) prior to BK000763BAA, BK000765BAA, or CU000101BAA. The issue stems from a lack of authentication mechanisms for critical functions, as documented in the National Vulnerability Database (NVD) with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and mapped to CWE-306.

A remote attacker within Bluetooth range of the affected scanner's base station can exploit this vulnerability without authentication. Exploitation requires user interaction, allowing the attacker to remotely execute system commands on the host device connected to the base station. This grants high-impact confidentiality and integrity violations, potentially compromising the connected system.

Honeywell advisories, as referenced in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-4272), strongly recommend upgrading to the latest firmware versions identified for each affected base station model to mitigate the vulnerability. No additional workaround details are provided in the available references.

Details

CWE(s)
CWE-306

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Missing authentication enables unauthenticated exploitation of the base station's Bluetooth interface (T1210) to execute system commands on the connected host (T1059).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References