CVE-2019-13523

Published: Sep 26, 2019Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.

Affected (59)

Products: Honeywell: Hbd3pr2 Firmware, H4d3prv3 Firmware, Hed3pr3 Firmware, H4d3prv2 Firmware, Hbd3pr1 Firmware, H4w8pr2 Firmware, Hbw8pr2 Firmware, H2w2pc1m Firmware, H2w4per3 Firmware, H2w2per3 Firmware, Hew2per3 Firmware, Hew4per3b Firmware, Hbw2per1 Firmware, Hew4per2 Firmware, Hew4per2b Firmware, Hew2per2 Firmware, H4w2per2 Firmware, Hbw2per2 Firmware, H4w2per3 Firmware, Hpw2p1 Firmware, Hen08104 Firmware, Hen08144 Firmware, Hen081124 Firmware, Hen16104 Firmware, Hen16144 Firmware, Hen16184 Firmware, Hen16204 Firmware, Hen162244 Firmware, Hen16284 Firmware, Hen16304 Firmware, Hen16384 Firmware, Hen32104 Firmware, Hen321124 Firmware, Hen32204 Firmware, Hen32284 Firmware, Hen322164 Firmware, Hen32304 Firmware, Hen32384 Firmware, Hen323164 Firmware, Hen64204 Firmware, Hen64304 Firmware, Hen643164 Firmware, Hen643324 Firmware, Hen643484 Firmware, Hen04103 Firmware, Hen04113 Firmware, Hen04123 Firmware, Hen08103 Firmware, Hen08113 Firmware, Hen08123 Firmware, Hen08143 Firmware, Hen16103 Firmware, Hen16123 Firmware, Hen16143 Firmware, Hen16163 Firmware, Hen04103l Firmware, Hen08103l Firmware, Hen16103l Firmware, Hen32103l Firmware

59 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hbd3pr2 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hbd3pr2	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H4d3prv3 Firmware	All versions

Running on/with	Platform Versions
Honeywell H4d3prv3	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hed3pr3 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hed3pr3	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H4d3prv2 Firmware	All versions

Running on/with	Platform Versions
Honeywell H4d3prv2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hbd3pr1 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hbd3pr1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H4w8pr2 Firmware	All versions

Running on/with	Platform Versions
Honeywell H4w8pr2	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hbw8pr2 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hbw8pr2	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H2w2pc1m Firmware	All versions

Running on/with	Platform Versions
Honeywell H2w2pc1m	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H2w4per3 Firmware	All versions

Running on/with	Platform Versions
Honeywell H2w4per3	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H2w2per3 Firmware	All versions

Running on/with	Platform Versions
Honeywell H2w2per3	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hew2per3 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hew2per3	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hew4per3b Firmware	All versions

Running on/with	Platform Versions
Honeywell Hew4per3b	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hbw2per1 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hbw2per1	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hew4per2 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hew4per2	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hew4per2b Firmware	All versions

Running on/with	Platform Versions
Honeywell Hew4per2b	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hew2per2 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hew2per2	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H4w2per2 Firmware	All versions

Running on/with	Platform Versions
Honeywell H4w2per2	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hbw2per2 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hbw2per2	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell H4w2per3 Firmware	All versions

Running on/with	Platform Versions
Honeywell H4w2per3	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hpw2p1 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hpw2p1	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08104 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08104	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08144 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08144	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen081124 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen081124	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16104 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16104	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16144 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16144	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16184 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16184	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16204 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16204	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen162244 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen162244	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16284 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16284	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16304 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16304	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16384 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16384	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32104 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32104	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen321124 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen321124	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32204 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32204	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32284 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32284	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen322164 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen322164	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32304 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32304	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32384 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32384	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen323164 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen323164	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen64204 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen64204	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen64304 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen64304	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen643164 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen643164	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen643324 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen643324	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen643484 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen643484	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen04103 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen04103	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen04113 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen04113	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen04123 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen04123	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08103 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08103	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08113 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08113	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08123 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08123	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08143 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08143	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16103 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16103	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16123 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16123	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16143 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16143	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16163 Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16163	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen04103l Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen04103l	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen08103l Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen08103l	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen16103l Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen16103l	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Hen32103l Firmware	All versions

Running on/with	Platform Versions
Honeywell Hen32103l	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.us-cert.gov/ics/advisories/icsa-19-260-03

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsa-19-260-03

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.