Honeywell HBW2PER1 Firmware vulnerabilities

5 CVEs affecting Honeywell HBW2PER1 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-39364, published 2022-02-24.

More from Honeywell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-18228, published 2019-10-31. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HTTP packet request could result in a denial of service.
• CVE-2019-13523, published 2019-09-26. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras…
• CVE-2021-39363, published 2022-02-24. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.
• CVE-2019-18226, published 2019-10-31. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and recorders have a potential replay attack vulnerability as…
• CVE-2021-39364, published 2022-02-24. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.