Honeywell I-HIB2PI-UL CCTV Camera
From Wiki-IoT
| Honeywell I-HIB2PI-UL CCTV Camera | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Honeywell I-HIB2PI-UL CCTV Camera
Brand: Honeywell (Parent: Honeywell International Inc.) Category: CCTV / IP Camera • Model / Gen: I-HIB2PI-UL I-HIB2PI-UL 2MP IP Release Date: 2020-01-01 • Status: End of life Classification Date: 2026-10-25 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper mechanism reported. |
| Known vulnerabilities | Very common | 🔗 Proof | CVE-2026-1670 (CVSS 9.8): unauthenticated API endpoint allows recovery email change. |
| Prior attacks | Rare | 🔗 Proof | No active exploitation in the wild reported at time of advisory. |
| Updatability | Rare | 🔗 Proof | Product discontinued April 2025; users must contact Honeywell support for patch info. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | Unauthenticated API endpoint exposed for password recovery function. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | No specific transport encryption vulnerability disclosed. |
| Storage | No encryption | 🔗 Proof | No evidence of encrypted storage for account recovery data. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Absent | 🔗 Proof | Recovery email can be changed without authentication, enabling account takeover. |
| Authentication | Absent | 🔗 Proof | Missing authentication for critical function (CWE-306); remote unauthenticated attacker. |
| Brute-force protection | Absent | 🔗 Proof | No brute-force protection needed; no credentials required to exploit. |
| Event logging | Absent | 🔗 Proof | No logging of unauthorized recovery email changes mentioned in advisory. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Password recovery flow can be hijacked via unauthenticated email change. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Embedded Firmware (Companion App: Honeywell Camera App / Web Interface) |
| Hardware (CPU / GPU) | CPU: Unknown (Embedded SoC) • GPU: None |
| Memory & Storage | Memory: Unknown • Storage: Internal Flash |
| Power, Battery & Charging | Battery: None • Power: DC Power Adapter / PoE • Charging: None |
| Display & Camera | Display: None • Camera: 2MP IP Camera Lens |
| Sound & Connectivity | Sound: Unknown • Connectivity: Ethernet (RJ45), Network Video Streaming |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
