Is CVE-2026-4272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4272 being exploited in the wild.

How severe is CVE-2026-4272?

High severity, with a CVSS score of 8.1, published 5 April 2026.

Which products and versions are affected?

Honeywell Handheld Scanners A1/B1 Base before BK000763BAA_BK000765BAA_CU000101BAA; Honeywell Handheld Scanners C1 Base before GK000432BAA; Honeywell Handheld Scanners D1 Base before HE000085BAA.

Is there a fix for CVE-2026-4272?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4272 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-4272?

Check whether you run Honeywell Handheld Scanners A1/B1 Base, Honeywell Handheld Scanners C1 Base or Honeywell Handheld Scanners D1 Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4272: Honeywell Handheld Scanners missing authentication in base station

CVE-2026-4272 · Severity: high · CVSS 8.1 · Published 2026-04-05

Honeywell handheld barcode scanners are used in retail, logistics, and industrial environments to track inventory and process transactions. A security flaw allows an unauthorized person within Bluetooth range to bypass security checks and run commands on the computer connected to the scanner's base station. This could lead to the theft of sensitive data or the disruption of business operations.

Vendors: Honeywell.

Quick answers

Is CVE-2026-4272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4272 being exploited in the wild.
How severe is CVE-2026-4272?: High severity, with a CVSS score of 8.1, published 5 April 2026.
Which products and versions are affected?: Honeywell Handheld Scanners A1/B1 Base before BK000763BAA_BK000765BAA_CU000101BAA; Honeywell Handheld Scanners C1 Base before GK000432BAA; Honeywell Handheld Scanners D1 Base before HE000085BAA.
Is there a fix for CVE-2026-4272?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4272 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-4272?: Check whether you run Honeywell Handheld Scanners A1/B1 Base, Honeywell Handheld Scanners C1 Base or Honeywell Handheld Scanners D1 Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Missing Authentication for Critical Function (CWE-306) vulnerability exists in several Honeywell Handheld Scanner base stations, including the C1, D1, and A1/B1 models. The flaw allows an unauthenticated attacker within Bluetooth range of the base station to abuse the communication protocol to execute arbitrary system commands on the host machine connected to the scanner. While the CVSS vector provided by the vendor indicates a network attack vector with user interaction, the description specifically highlights the proximity-based Bluetooth vector. Honeywell has released firmware updates to address this issue and recommends immediate upgrades.

Affected products

Honeywell Handheld Scanners C1 Base (Ingenic x1000) before GK000432BAA
Honeywell Handheld Scanners D1 Base (Ingenic x1600) before HE000085BAA
Honeywell Handheld Scanners A1/B1 Base (IMX25) before BK000763BAA_BK000765BAA_CU000101BAA

Timeline

2026-04-05: disclosed
2026-04-05: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.