CVE-2019-13523: Infoleak
In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13523?
CVE-2019-13523 has been rated as medium severity due to its potential to expose sensitive configuration data without any authentication.
How do I fix CVE-2019-13523?
To fix CVE-2019-13523, update the affected Honeywell Performance IP Cameras and Performance NVRs to the latest firmware version that addresses this vulnerability.
What devices are affected by CVE-2019-13523?
CVE-2019-13523 affects various Honeywell Performance IP Cameras and Performance NVRs, specifically those running vulnerable firmware versions.
Can CVE-2019-13523 be exploited remotely?
Yes, CVE-2019-13523 can be exploited remotely since the vulnerability allows attackers to access web configuration data over the network without authentication.
What type of data can be exposed by CVE-2019-13523?
CVE-2019-13523 can expose sensitive web configuration data in JSON format for affected Honeywell devices.