CVE-2021-39364: High severity honeywell hdzp252di firmware vulnerability
Published Feb 24, 2022
·Updated
Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.
Affected Software
4 affected components
Honeywell Hdzp252di Firmware=1.00.hw02.4
Honeywell HDZP252DI
Honeywell Hbw2per1 Firmware=1.000.hw01.3
Honeywell HBW2PER1
Event History
Feb 24, 2022
CVE Published
via MITRE·09:13 PM
Data Sourced
via MITRE·09:13 PM
Description
Frequently Asked Questions
1
What is CVE-2021-39364?
CVE-2021-39364 is a vulnerability that allows command spoofing for camera control on Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices after ARP cache poisoning.
2
What is the severity of CVE-2021-39364?
CVE-2021-39364 has a severity rating of 7.5 (high).
3
Which devices are affected by CVE-2021-39364?
Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices are affected by CVE-2021-39364.
4
How can command spoofing be achieved on the affected devices?
Command spoofing can be achieved on the affected devices after ARP cache poisoning.
5
How can I fix CVE-2021-39364?
To fix CVE-2021-39364, it is recommended to refer to the vendor's security notification and follow their recommended actions.