Riskcovery

CVE-2025-12351

Inadequate access control measure allows unauthorized users to access restricted administrative functions

State
Published
Severity
6.8 Medium
Published
Oct 27, 2025
Updated
Oct 27, 2025
Reserved
Oct 27, 2025

Read the record on cve.org

Description

Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NHoneywell

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

ProductVersions
S35 3M/5M/8M/Pinhole/Kit CameraHoneywell
  • 2022.02.28 to before 2025.08.28Affected
S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet CameraHoneywell
  • 2024.08.10 to before 2025.08.22Affected
S35 Thermal CameraHoneywell
  • 2024.10.21 to before 2025.08.26Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.