CVE-2025-12351
Medium
Description
Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).
SeverityMedium
CVSS6.8
Exploit probability—
ProductS35 3M/5M/8M/Pinhole/Kit Camera
PublishedOct 27, 2025
First seenOct 27, 2025
How to fix
Update
- Honeywell S35 3M/5M/8M/Pinhole/Kit Camera2025.08.28 or later
- Honeywell S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera2025.08.22 or later
- Honeywell S35 Thermal Camera2025.08.26 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Honeywell S35 3M/5M/8M/Pinhole/Kit Camera | 2022.02.28 ≤ v < 2025.08.28 | 2025.08.28 |
| Honeywell S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera | 2024.08.10 ≤ v < 2025.08.22 | 2025.08.22 |
| Honeywell S35 Thermal Camera | 2024.10.21 ≤ v < 2025.08.26 | 2025.08.26 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.