Vulnerability-Lookup

CVE-2026-4272 (GCVE-0-2026-4272)

Vulnerability from cvelistv5 – Published: 2026-04-05 22:00 – Updated: 2026-04-06 14:01

Title

CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability

Summary

Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA. This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

Honeywell

References

1 reference

URL	Tags
https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272

Impacted products

1 product

Vendor	Product	Version
Honeywell	Barcode Scanners	Affected: C1 Base(Ingenic x1000) , < GK000432BAA (custom) Affected: D1 Base(Ingenic x1600) , < HE000085BAA (custom) Affected: A1/B1 Base(IMX25) , < BK000763BAA_BK000765BAA_CU000101BAA (custom)

Credits

Kaspersky Haidar Kabibo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T14:00:57.144252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T14:01:35.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Barcode Scanners",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThan": "GK000432BAA",
              "status": "affected",
              "version": "C1 Base(Ingenic x1000)",
              "versionType": "custom"
            },
            {
              "lessThan": "HE000085BAA",
              "status": "affected",
              "version": "D1 Base(Ingenic x1600)",
              "versionType": "custom"
            },
            {
              "lessThan": "BK000763BAA_BK000765BAA_CU000101BAA",
              "status": "affected",
              "version": "A1/B1 Base(IMX25)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kaspersky"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Haidar Kabibo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.\u003cp\u003eThis issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\u003c/p\u003eThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u0026nbsp;\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-4272\"\u003eCVE-2026-4272\u003c/a\u003e and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\n\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272  and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-05T22:00:27.141Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "url": "https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2026-4272",
    "datePublished": "2026-04-05T22:00:27.141Z",
    "dateReserved": "2026-03-16T14:45:35.186Z",
    "dateUpdated": "2026-04-06T14:01:35.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-4272",
      "date": "2026-08-10",
      "epss": "0.00453",
      "percentile": "0.37185"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-4272\",\"sourceIdentifier\":\"psirt@honeywell.com\",\"published\":\"2026-04-05T22:16:01.697\",\"lastModified\":\"2026-07-24T20:10:00.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\\n\\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272  and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad \u0027Missing Authentication for Critical Function\u0027 en los esc\u00e1neres port\u00e1tiles Honeywell permite el abuso de autenticaci\u00f3n. Este problema afecta a los esc\u00e1neres port\u00e1tiles: desde C1 Base (Ingenic x1000) anterior a GK000432BAA, desde D1 Base (Ingenic x1600) anterior a HE000085BAA, desde A1/B1 Base (IMX25) anterior a BK000763BAA_BK000765BAA_CU000101BAA.\\n\\nEsta vulnerabilidad podr\u00eda permitir que un atacante remoto dentro del alcance de Bluetooth de la estaci\u00f3n base del esc\u00e1ner tenga la capacidad de ejecutar comandos del sistema de forma remota en el host conectado a la estaci\u00f3n base sin autenticaci\u00f3n. A este problema se le ha asignado CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 y se ha calificado con una severidad de Alta. Honeywell recomienda encarecidamente que los usuarios actualicen a la \u00faltima versi\u00f3n identificada para resolver la vulnerabilidad.\"}],\"affected\":[{\"source\":\"psirt@honeywell.com\",\"affectedData\":[{\"vendor\":\"Honeywell\",\"product\":\"Barcode Scanners\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"C1 Base(Ingenic x1000)\",\"lessThan\":\"GK000432BAA\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"D1 Base(Ingenic x1600)\",\"lessThan\":\"HE000085BAA\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"A1/B1 Base(IMX25)\",\"lessThan\":\"BK000763BAA_BK000765BAA_CU000101BAA\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@honeywell.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-06T14:00:57.144252Z\",\"id\":\"CVE-2026-4272\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@honeywell.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272\",\"source\":\"psirt@honeywell.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-06T22:59:15+00:00",
      "cve": "CVE-2026-4272",
      "id": "CVE-2026-4272",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "- Bluetooth Remote Execution of System Commands Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4272.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Kaspersky\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Haidar Kabibo\"}], \"impacts\": [{\"capecId\": \"CAPEC-114\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-114 Authentication Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Honeywell\", \"product\": \"Barcode Scanners\", \"versions\": [{\"status\": \"affected\", \"version\": \"C1 Base(Ingenic x1000)\", \"lessThan\": \"GK000432BAA\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"D1 Base(Ingenic x1600)\", \"lessThan\": \"HE000085BAA\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"A1/B1 Base(IMX25)\", \"lessThan\": \"BK000763BAA_BK000765BAA_CU000101BAA\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\\n\\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272  and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.\u003cp\u003eThis issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\u003c/p\u003eThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u0026nbsp;\u003ca href=\\\"https://nvd.nist.gov/vuln/detail/CVE-2026-4272\\\"\u003eCVE-2026-4272\u003c/a\u003e and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"shortName\": \"Honeywell\", \"dateUpdated\": \"2026-04-05T22:00:27.141Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4272\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-06T14:00:57.144252Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-04-06T14:01:25.873Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-4272\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-05T22:00:27.141Z\", \"dateReserved\": \"2026-03-16T14:45:35.186Z\", \"assignerOrgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"datePublished\": \"2026-04-05T22:00:27.141Z\", \"assignerShortName\": \"Honeywell\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-4272

Vulnerability from fkie_nvd - Published: 2026-04-05 22:16 - Updated: 2026-06-17 10:56

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	psirt@honeywell.com	https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Barcode Scanners",
          "vendor": "Honeywell",
          "versions": [
            {
              "lessThan": "GK000432BAA",
              "status": "affected",
              "version": "C1 Base(Ingenic x1000)",
              "versionType": "custom"
            },
            {
              "lessThan": "HE000085BAA",
              "status": "affected",
              "version": "D1 Base(Ingenic x1600)",
              "versionType": "custom"
            },
            {
              "lessThan": "BK000763BAA_BK000765BAA_CU000101BAA",
              "status": "affected",
              "version": "A1/B1 Base(IMX25)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@honeywell.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\n\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272  and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability."
    }
  ],
  "id": "CVE-2026-4272",
  "lastModified": "2026-06-17T10:56:20.347",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "psirt@honeywell.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4272",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-06T14:00:57.144252Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-05T22:16:01.697",
  "references": [
    {
      "source": "psirt@honeywell.com",
      "url": "https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
    }
  ],
  "sourceIdentifier": "psirt@honeywell.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "psirt@honeywell.com",
      "type": "Secondary"
    }
  ]
}

GHSA-396R-WG2M-QXG7

Vulnerability from github – Published: 2026-04-06 00:30 – Updated: 2026-04-06 00:30

Details

This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-4272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-05T22:16:01Z",
    "severity": "HIGH"
  },
  "details": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\n\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272  and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.",
  "id": "GHSA-396r-wg2m-qxg7",
  "modified": "2026-04-06T00:30:24Z",
  "published": "2026-04-06T00:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
    },
    {
      "type": "ADVISORY",
      "url": "https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-4272 (GCVE-0-2026-4272)

FKIE_CVE-2026-4272

GHSA-396R-WG2M-QXG7

Tags

Sightings

Nomenclature