TI-2026-03717 Aliases CVE-2026-4272 GHSA-396r-wg2m-qxg7

CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability

LOW 36CWE-306Published 2026-04-05 · Updated 2026-04-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA. This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00664 51st percentileScored 2026-11-07

Fix Fixed Barcode Scanners (Honeywell): GK000432BAA, HE000085BAA, BK000763BAA_BK000765BAA_CU000101BAA

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Honeywell	Barcode Scanners	C1 Base(Ingenic x1000) to before GK000432BAA; D1 Base(Ingenic x1600) to before HE000085BAA; A1/B1 Base(IMX25) to before BK000763BAA_BK000765BAA_CU000101BAA	GK000432BAA, HE000085BAA, BK000763BAA_BK000765BAA_CU000101BAA	Patch available	CNA

Barcode Scanners VendorHoneywell Affected C1 Base(Ingenic x1000) to before GK000432BAA; D1 Base(Ingenic x1600) to before HE000085BAA; A1/B1 Base(IMX25) to before BK000763BAA_BK000765BAA_CU000101BAA Fixed in GK000432BAA, HE000085BAA, BK000763BAA_BK000765BAA_CU000101BAA Patch available CNA

Remediation

Fix · CNA Barcode Scanners (Honeywell) Fixed in GK000432BAA, HE000085BAA, BK000763BAA_BK000765BAA_CU000101BAA

Timeline

2026-10-02 Threatist record created from CVE-2026-4272
2026-10-03 Alias added: GHSA-396r-wg2m-qxg7
2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 1

https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272

TI-2023-03466 Printer web page invalid command execution CVSS 3.1CRITICAL 9.9
TI-2021-22482 WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2021-22480 WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2007-02844 Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module… CVSS 2.0HIGH 10.0
TI-2023-18324 MAS (a Carrier brand) MASmobile Classic Authorization Bypass CVSS 3.1MEDIUM 6.5
TI-2023-28253 XML external entity injection in Honeywell Saia PG5 Controls Suite CVSS 3.1MEDIUM 6.5

See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences