CVE-2025-12351 - CVE House
Back to Database
Status published Medium CVE-2025-12351

Inadequate access control measure allows unauthorized users to access restricted administrative functions

Vulnerability Description

Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12351

Credits & Attribution

No credits recorded in the NVD database.

References

More from Honeywell

View All →
CVE-2025-3947
Integer underflow during processing of short network packets in CDA FTEB responder
High 8.2
CVE-2025-3946
Incorrect response generation during FTEB protocol processing
High 8.2
CVE-2025-2605
Authenticated command injection
Critical 9.9
CVE-2025-2523
Lack of buffer clearing before reuse may result in incorrect system behavior.
Critical 9.4
CVE-2025-2522
Lack of buffer clearing before reuse may result in incorrect system behavior.
Medium 6.5

Affected Vendor

Affected Software

S35 3M/5M/8M/Pinhole/Kit Camera, S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera, S35 Thermal Camera
Vulnerable Versions:
2022.02.28, 2024.08.10, 2024.10.21

Timeline

Official Publish: October 27th, 2025
Last Modified: October 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-639 CWE-668

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation
T1005 Data from Local System
Collection