A missing authentication flaw in Honeywell handheld barcode scanners permits an unauthenticated attacker with Bluetooth connectivity to send commands that are executed directly on the host computer. The vulnerability enables remote execution of system commands, allowing an attacker to alter data, read sensitive information, or disrupt services. This weakness is categorized as a missing authentication for a critical function (CWE‑306).

Users of Honeywell barcode scanners are impacted if they operate models C1 Base (Ingenic x1000) with firmware before GK000432BAA, D1 Base (Ingenic x1600) with firmware before HE000085BAA, or A1/B1 Base (IMX25) with firmware before BK000763BAA, BK000765BAA, or CU000101BAA.

The vulnerability carries a CVSS score of 8.1, indicating a high severity level. No EPSS score is available and the issue is not listed in the CISA KEV catalog. An attacker only needs to be within Bluetooth range of the scanner’s base station and can exploit the flaw without any authentication. This means the potential attack surface is relatively simple, and the likelihood of exploitation is moderate to high. Successful exploitation could compromise the confidentiality, integrity, and availability of the host system connected to the scanner.