Lucene search

[email protected]CVE-2019-13523

HistorySep 26, 2019 - 4:15 p.m.

CVE-2019-13523

2019-09-2616:15:11

CWE-306

CWE-200

[email protected]

web.nvd.nist.gov

100

honeywell

ip cameras

nvrs

cve-2019-13523

vulnerability

web server

unauthorized access

json

authentication

network security

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.

Affected configurations

NVD

Node

honeywellhbd3pr2_firmwareMatch-

AND

honeywellhbd3pr2Match-

Node

honeywellh4d3prv3_firmwareMatch-

AND

honeywellh4d3prv3Match-

Node

honeywellhed3pr3_firmwareMatch-

AND

honeywellhed3pr3Match-

Node

honeywellh4d3prv2_firmwareMatch-

AND

honeywellh4d3prv2Match-

Node

honeywellhbd3pr1_firmwareMatch-

AND

honeywellhbd3pr1Match-

Node

honeywellh4w8pr2_firmwareMatch-

AND

honeywellh4w8pr2Match-

Node

honeywellhbw8pr2_firmwareMatch-

AND

honeywellhbw8pr2Match-

Node

honeywellh2w2pc1m_firmwareMatch-

AND

honeywellh2w2pc1mMatch-

Node

honeywellh2w4per3_firmwareMatch-

AND

honeywellh2w4per3Match-

Node

honeywellh2w2per3_firmwareMatch-

AND

honeywellh2w2per3Match-

Node

honeywellhew2per3_firmwareMatch-

AND

honeywellhew2per3Match-

Node

honeywellhew4per3b_firmwareMatch-

AND

honeywellhew4per3bMatch-

Node

honeywellhbw2per1_firmwareMatch-

AND

honeywellhbw2per1Match-

Node

honeywellhew4per2_firmwareMatch-

AND

honeywellhew4per2Match-

Node

honeywellhew4per2b_firmwareMatch-

AND

honeywellhew4per2bMatch-

Node

honeywellhew2per2_firmwareMatch-

AND

honeywellhew2per2Match-

Node

honeywellh4w2per2_firmwareMatch-

AND

honeywellh4w2per2Match-

Node

honeywellhbw2per2_firmwareMatch-

AND

honeywellhbw2per2Match-

Node

honeywellh4w2per3_firmwareMatch-

AND

honeywellh4w2per3Match-

Node

honeywellhpw2p1_firmwareMatch-

AND

honeywellhpw2p1Match-

Node

honeywellhen08104_firmwareMatch-

AND

honeywellhen08104Match-

Node

honeywellhen08144_firmwareMatch-

AND

honeywellhen08144Match-

Node

honeywellhen081124_firmwareMatch-

AND

honeywellhen081124Match-

Node

honeywellhen16104_firmwareMatch-

AND

honeywellhen16104Match-

Node

honeywellhen16144_firmwareMatch-

AND

honeywellhen16144Match-

Node

honeywellhen16184_firmwareMatch-

AND

honeywellhen16184Match-

Node

honeywellhen16204_firmwareMatch-

AND

honeywellhen16204Match-

Node

honeywellhen162244_firmwareMatch-

AND

honeywellhen162244Match-

Node

honeywellhen16284_firmwareMatch-

AND

honeywellhen16284Match-

Node

honeywellhen16304_firmwareMatch-

AND

honeywellhen16304Match-

Node

honeywellhen16384_firmwareMatch-

AND

honeywellhen16384Match-

Node

honeywellhen32104_firmwareMatch-

AND

honeywellhen32104Match-

Node

honeywellhen321124_firmwareMatch-

AND

honeywellhen321124Match-

Node

honeywellhen32204_firmwareMatch-

AND

honeywellhen32204Match-

Node

honeywellhen32284_firmwareMatch-

AND

honeywellhen32284Match-

Node

honeywellhen322164_firmwareMatch-

AND

honeywellhen322164Match-

Node

honeywellhen32304_firmwareMatch-

AND

honeywellhen32304Match-

Node

honeywellhen32384_firmwareMatch-

AND

honeywellhen32384Match-

Node

honeywellhen323164_firmwareMatch-

AND

honeywellhen323164Match-

Node

honeywellhen64204_firmwareMatch-

AND

honeywellhen64204Match-

Node

honeywellhen64304_firmwareMatch-

AND

honeywellhen64304Match-

Node

honeywellhen643164_firmwareMatch-

AND

honeywellhen643164Match-

Node

honeywellhen643324_firmwareMatch-

AND

honeywellhen643324Match-

Node

honeywellhen643484_firmwareMatch-

AND

honeywellhen643484Match-

Node

honeywellhen04103_firmwareMatch-

AND

honeywellhen04103Match-

Node

honeywellhen04113_firmwareMatch-

AND

honeywellhen04113Match-

Node

honeywellhen04123_firmwareMatch-

AND

honeywellhen04123Match-

Node

honeywellhen08103_firmwareMatch-

AND

honeywellhen08103Match-

Node

honeywellhen08113_firmwareMatch-

AND

honeywellhen08113Match-

Node

honeywellhen08123_firmwareMatch-

AND

honeywellhen08123Match-

Node

honeywellhen08143_firmwareMatch-

AND

honeywellhen08143Match-

Node

honeywellhen16103_firmwareMatch-

AND

honeywellhen16103Match-

Node

honeywellhen16123_firmwareMatch-

AND

honeywellhen16123Match-

Node

honeywellhen16143_firmwareMatch-

AND

honeywellhen16143Match-

Node

honeywellhen16163_firmwareMatch-

AND

honeywellhen16163Match-

Node

honeywellhen04103l_firmwareMatch-

AND

honeywellhen04103lMatch-

Node

honeywellhen08103l_firmwareMatch-

AND

honeywellhen08103lMatch-

Node

honeywellhen16103l_firmwareMatch-

AND

honeywellhen16103lMatch-

Node

honeywellhen32103l_firmwareMatch-

AND

honeywellhen32103lMatch-

CPENameOperatorVersion
honeywell:hbd3pr2_firmwarehoneywell hbd3pr2 firmwareeq-

CPE	Name	Operator	Version
honeywell:hbd3pr2_firmware	honeywell hbd3pr2 firmware	eq	-

CNA Affected

[
  {
    "product": "Performance IP Cameras",
    "vendor": "Honeywell",
    "versions": [
      {
        "status": "affected",
        "version": "HBD3PR2"
      },
      {
        "status": "affected",
        "version": "H4D3PRV3"
      },
      {
        "status": "affected",
        "version": "HED3PR3"
      },
      {
        "status": "affected",
        "version": "H4D3PRV2"
      },
      {
        "status": "affected",
        "version": "HBD3PR1"
      },
      {
        "status": "affected",
        "version": "H4W8PR2"
      },
      {
        "status": "affected",
        "version": "HBW8PR2"
      },
      {
        "status": "affected",
        "version": "H2W2PC1M"
      },
      {
        "status": "affected",
        "version": "H2W4PER3"
      },
      {
        "status": "affected",
        "version": "H2W2PER3"
      },
      {
        "status": "affected",
        "version": "HEW2PER3"
      },
      {
        "status": "affected",
        "version": "HEW4PER3B"
      },
      {
        "status": "affected",
        "version": "HBW2PER1"
      },
      {
        "status": "affected",
        "version": "HEW4PER2"
      },
      {
        "status": "affected",
        "version": "HEW4PER2B"
      },
      {
        "status": "affected",
        "version": "HEW2PER2"
      },
      {
        "status": "affected",
        "version": "H4W2PER2"
      },
      {
        "status": "affected",
        "version": "HBW2PER2"
      },
      {
        "status": "affected",
        "version": "H4W2PER3"
      },
      {
        "status": "affected",
        "version": "HPW2P1"
      }
    ]
  },
  {
    "product": "Performance NVRs",
    "vendor": "Honeywell",
    "versions": [
      {
        "status": "affected",
        "version": "HEN08104"
      },
      {
        "status": "affected",
        "version": "HEN08144"
      },
      {
        "status": "affected",
        "version": "HEN081124"
      },
      {
        "status": "affected",
        "version": "HEN16104"
      },
      {
        "status": "affected",
        "version": "HEN16144"
      },
      {
        "status": "affected",
        "version": "HEN16184"
      },
      {
        "status": "affected",
        "version": "HEN16204"
      },
      {
        "status": "affected",
        "version": "HEN162244"
      },
      {
        "status": "affected",
        "version": "HEN16284"
      },
      {
        "status": "affected",
        "version": "HEN16304"
      },
      {
        "status": "affected",
        "version": "HEN16384"
      },
      {
        "status": "affected",
        "version": "HEN32104"
      },
      {
        "status": "affected",
        "version": "HEN321124"
      },
      {
        "status": "affected",
        "version": "HEN32204"
      },
      {
        "status": "affected",
        "version": "HEN32284"
      },
      {
        "status": "affected",
        "version": "HEN322164"
      },
      {
        "status": "affected",
        "version": "HEN32304"
      },
      {
        "status": "affected",
        "version": "HEN32384"
      },
      {
        "status": "affected",
        "version": "HEN323164"
      },
      {
        "status": "affected",
        "version": "HEN64204"
      },
      {
        "status": "affected",
        "version": "HEN64304"
      },
      {
        "status": "affected",
        "version": "HEN643164"
      },
      {
        "status": "affected",
        "version": "HEN643324"
      },
      {
        "status": "affected",
        "version": "HEN643484"
      },
      {
        "status": "affected",
        "version": "HEN04103"
      },
      {
        "status": "affected",
        "version": "HEN04113"
      },
      {
        "status": "affected",
        "version": "HEN04123"
      },
      {
        "status": "affected",
        "version": "HEN08103"
      },
      {
        "status": "affected",
        "version": "HEN08113"
      },
      {
        "status": "affected",
        "version": "HEN08123"
      },
      {
        "status": "affected",
        "version": "HEN08143"
      },
      {
        "status": "affected",
        "version": "HEN16103"
      },
      {
        "status": "affected",
        "version": "HEN16123"
      },
      {
        "status": "affected",
        "version": "HEN16143"
      },
      {
        "status": "affected",
        "version": "HEN16163"
      },
      {
        "status": "affected",
        "version": "HEN04103L"
      },
      {
        "status": "affected",
        "version": "HEN08103L"
      },
      {
        "status": "affected",
        "version": "HEN16103L"
      },
      {
        "status": "affected",
        "version": "HEN32103L"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-19-260-03

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

Related for CVE-2019-13523

cvelist1 nvd1 ics1 prion1