CVE-2025-12351

MediumCVSS 6.8

Published: 27/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Honeywell S35 Series Cameras contain an authorization bypass vulnerability through the User controller key. An attacker could exploit this to escalate privileges to admin-level functionalities.

Risk Assessment

Exploitation may allow an unauthorized user to gain administrator privileges and take control of the cameras and related functions.

Recommendation

Update Honeywell S35 cameras to the latest versions specified by the vendor (e.g., 2025.08.28, 2025.08.22, 2025.08.26 depending on the model).

Other vulnerabilities in Honeywell S35 Series Cameras

CVE-2026-17612Medium
Honeywell S35 Series cameras (3M/5M/8M/PinHole) versions up to HC5.26.1.14.20260207 contain an audit log disclosure vulnerability that allows an attacker to access audit logs without authentication, potentially leading to disclosure of sensitive information.

Original NVD description (English source)

Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS