CVE-2019-13523 : In Honeywell Performance IP Cameras and Performance NVRs, the integrated web ser

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.

Published 2019-09-26 16:15:11

Updated 2021-10-28 15:09:26

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2019-13523

Honeywell » Hbd3pr2 Firmware » Version: N/A
cpe:2.3:o:honeywell:hbd3pr2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hbd3pr2 » Version: N/A
Honeywell » H4d3prv3 Firmware » Version: N/A
cpe:2.3:o:honeywell:h4d3prv3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H4d3prv3 » Version: N/A
Honeywell » Hed3pr3 Firmware » Version: N/A
cpe:2.3:o:honeywell:hed3pr3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hed3pr3 » Version: N/A
Honeywell » H4d3prv2 Firmware » Version: N/A
cpe:2.3:o:honeywell:h4d3prv2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H4d3prv2 » Version: N/A
Honeywell » Hbd3pr1 Firmware » Version: N/A
cpe:2.3:o:honeywell:hbd3pr1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hbd3pr1 » Version: N/A
Honeywell » H4w8pr2 Firmware » Version: N/A
cpe:2.3:o:honeywell:h4w8pr2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H4w8pr2 » Version: N/A
Honeywell » Hbw8pr2 Firmware » Version: N/A
cpe:2.3:o:honeywell:hbw8pr2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hbw8pr2 » Version: N/A
Honeywell » H2w2pc1m Firmware » Version: N/A
cpe:2.3:o:honeywell:h2w2pc1m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H2w2pc1m » Version: N/A
Honeywell » H2w4per3 Firmware » Version: N/A
cpe:2.3:o:honeywell:h2w4per3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H2w4per3 » Version: N/A
Honeywell » H2w2per3 Firmware » Version: N/A
cpe:2.3:o:honeywell:h2w2per3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H2w2per3 » Version: N/A
Honeywell » Hew2per3 Firmware » Version: N/A
cpe:2.3:o:honeywell:hew2per3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hew2per3 » Version: N/A
Honeywell » Hew4per3b Firmware » Version: N/A
cpe:2.3:o:honeywell:hew4per3b_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hew4per3b » Version: N/A
Honeywell » Hbw2per1 Firmware » Version: N/A
cpe:2.3:o:honeywell:hbw2per1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hbw2per1 » Version: N/A
Honeywell » Hew4per2 Firmware » Version: N/A
cpe:2.3:o:honeywell:hew4per2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hew4per2 » Version: N/A
Honeywell » Hew4per2b Firmware » Version: N/A
cpe:2.3:o:honeywell:hew4per2b_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hew4per2b » Version: N/A
Honeywell » Hew2per2 Firmware » Version: N/A
cpe:2.3:o:honeywell:hew2per2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hew2per2 » Version: N/A
Honeywell » H4w2per2 Firmware » Version: N/A
cpe:2.3:o:honeywell:h4w2per2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H4w2per2 » Version: N/A
Honeywell » Hbw2per2 Firmware » Version: N/A
cpe:2.3:o:honeywell:hbw2per2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hbw2per2 » Version: N/A
Honeywell » H4w2per3 Firmware » Version: N/A
cpe:2.3:o:honeywell:h4w2per3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » H4w2per3 » Version: N/A
Honeywell » Hpw2p1 Firmware » Version: N/A
cpe:2.3:o:honeywell:hpw2p1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hpw2p1 » Version: N/A
Honeywell » Hen08104 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08104_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08104 » Version: N/A
Honeywell » Hen08144 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08144_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08144 » Version: N/A
Honeywell » Hen081124 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen081124_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen081124 » Version: N/A
Honeywell » Hen16104 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16104_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16104 » Version: N/A
Honeywell » Hen16144 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16144_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16144 » Version: N/A
Honeywell » Hen16184 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16184_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16184 » Version: N/A
Honeywell » Hen16204 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16204_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16204 » Version: N/A
Honeywell » Hen162244 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen162244_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen162244 » Version: N/A
Honeywell » Hen16284 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16284_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16284 » Version: N/A
Honeywell » Hen16304 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16304_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16304 » Version: N/A
Honeywell » Hen16384 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16384_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16384 » Version: N/A
Honeywell » Hen32104 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32104_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32104 » Version: N/A
Honeywell » Hen321124 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen321124_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen321124 » Version: N/A
Honeywell » Hen32204 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32204_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32204 » Version: N/A
Honeywell » Hen32284 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32284_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32284 » Version: N/A
Honeywell » Hen322164 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen322164_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen322164 » Version: N/A
Honeywell » Hen32304 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32304_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32304 » Version: N/A
Honeywell » Hen32384 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32384_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32384 » Version: N/A
Honeywell » Hen323164 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen323164_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen323164 » Version: N/A
Honeywell » Hen64204 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen64204_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen64204 » Version: N/A
Honeywell » Hen64304 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen64304_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen64304 » Version: N/A
Honeywell » Hen643164 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen643164_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen643164 » Version: N/A
Honeywell » Hen643324 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen643324_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen643324 » Version: N/A
Honeywell » Hen643484 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen643484_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen643484 » Version: N/A
Honeywell » Hen04103 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen04103_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen04103 » Version: N/A
Honeywell » Hen04113 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen04113_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen04113 » Version: N/A
Honeywell » Hen04123 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen04123_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen04123 » Version: N/A
Honeywell » Hen08103 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08103_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08103 » Version: N/A
Honeywell » Hen08113 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08113_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08113 » Version: N/A
Honeywell » Hen08123 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08123_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08123 » Version: N/A
Honeywell » Hen08143 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08143_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08143 » Version: N/A
Honeywell » Hen16103 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16103_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16103 » Version: N/A
Honeywell » Hen16123 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16123_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16123 » Version: N/A
Honeywell » Hen16143 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16143_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16143 » Version: N/A
Honeywell » Hen16163 Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16163_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16163 » Version: N/A
Honeywell » Hen04103l Firmware » Version: N/A
cpe:2.3:o:honeywell:hen04103l_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen04103l » Version: N/A
Honeywell » Hen08103l Firmware » Version: N/A
cpe:2.3:o:honeywell:hen08103l_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen08103l » Version: N/A
Honeywell » Hen16103l Firmware » Version: N/A
cpe:2.3:o:honeywell:hen16103l_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen16103l » Version: N/A
Honeywell » Hen32103l Firmware » Version: N/A
cpe:2.3:o:honeywell:hen32103l_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Honeywell » Hen32103l » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-13523

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-13523

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2019-13523

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: ics-cert@hq.dhs.gov (Secondary)
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-13523

https://www.us-cert.gov/ics/advisories/icsa-19-260-03

Honeywell Performance IP Cameras and Performance NVRs | CISA
Mitigation;Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2019-13523

Products affected by CVE-2019-13523

Exploit prediction scoring system (EPSS) score for CVE-2019-13523

CVSS scores for CVE-2019-13523

CWE ids for CVE-2019-13523

References for CVE-2019-13523