PT-2026-30510 · Imx25+2 · Imx25+3

Haidar Kabibo + 1 · Published 2026-04-05 · Updated 2026-04-14 · CVE-2026-4272

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Honeywell Handheld Scanners versions prior to C1 Base(Ingenic x1000) GK000432BAA, prior to D1 Base(Ingenic x1600) HE000085BAA, and prior to A1/B1 Base(IMX25) BK000763BAA BK000765BAA CU000101BAA.

Description A missing authentication check for a critical function in Honeywell Handheld Scanners allows for authentication abuse. A remote attacker within Bluetooth range of the scanner's base station can remotely execute system commands on the connected host without authentication.

Recommendations Upgrade to C1 Base(Ingenic x1000) GK000432BAA or later. Upgrade to D1 Base(Ingenic x1600) HE000085BAA or later. Upgrade to A1/B1 Base(IMX25) BK000763BAA BK000765BAA CU000101BAA or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-05577

CVE-2026-4272

Affected Products

Honeywell Handheld Scanners

Imx25

Ingenic X1000

Ingenic X1600

References · 10

• https://bdu.fstec.ru/vul/2026-05577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4272 · Security Note
• https://twitter.com/CVEnew/status/2040919028479447053 · Twitter Post
• https://thehackerwire.com/vulnerability/CVE-2026-4272 · Note
• https://twitter.com/infoflowcloud/status/2040920055177732276 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040916529290899719 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2040924245283201495 · Twitter Post
• https://honeywell.com/us/en/product-security#security-notices · Note
• https://https//nvd.nist.gov/vuln/detail/CVE-2026-4272 · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-30510 · Note