Vulnerability-Lookup

CNVD-2019-39763

Vulnerability from cnvd - Published: 2019-11-08

Title

Honeywell equIP系列和Performance系列IP摄像头访问控制错误漏洞

Description

Honeywell equIP H4L2GR1等都是美国霍尼韦尔（Honeywell）公司的一款IP摄像机。 Honeywell equIP系列和Performance系列IP摄像头中存在访问控制错误漏洞，攻击者可利用该漏洞进行未授权访问。

Severity

中

Patch Name

Honeywell equIP系列和Performance系列IP摄像头访问控制错误漏洞的补丁

Patch Description

Honeywell equIP H4L2GR1等都是美国霍尼韦尔（Honeywell）公司的一款IP摄像机。 Honeywell equIP系列和Performance系列IP摄像头中存在访问控制错误漏洞，攻击者可利用该漏洞进行未授权访问。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.honeywell.com/

Reference

https://www.us-cert.gov/ics/advisories/icsa-19-304-03 https://nvd.nist.gov/vuln/detail/CVE-2019-18230

Impacted products

Name
['Honeywell equIP H3W2GR1', 'Honeywell equIP H3W2GR1V', 'Honeywell equIP H3W2GR2', 'Honeywell equIP H3W4GR1', 'Honeywell equIP H3W4GR1V', 'Honeywell equIP H4D8GR1', 'Honeywell equIP H4L2GR1V', 'Honeywell equIP H4L6GR2', 'Honeywell equIP H4LGGR2', 'Honeywell equIP H4W2GR1', 'Honeywell equIP H4W2GR1V', 'Honeywell equIP H4W2GR2', 'Honeywell equIP H4W4GR1', 'Honeywell equIP H4W4GR1V', 'Honeywell equIP HBD8GR1', 'Honeywell equIP HBL2GR1', 'Honeywell equIP HBL2GR1V', 'Honeywell equIP HBL6GR2', 'Honeywell equIP HBW2GR1', 'Honeywell equIP HBW2GR1V', 'Honeywell equIP HBW2GR3', 'Honeywell equIP HBW2GR3V', 'Honeywell Performance HDZ302DIN-S1', 'Honeywell Performance HDZ302LIK', 'Honeywell Performance HDZ302LIW', 'Honeywell Performance HFD6GR1', 'Honeywell Performance HFD8GR1', 'Honeywell Performance HM4L8GR1', 'Honeywell Performance HMBL8GR1']

Name

['Honeywell equIP H3W2GR1', 'Honeywell equIP H3W2GR1V', 'Honeywell equIP H3W2GR2', 'Honeywell equIP H3W4GR1', 'Honeywell equIP H3W4GR1V', 'Honeywell equIP H4D8GR1', 'Honeywell equIP H4L2GR1V', 'Honeywell equIP H4L6GR2', 'Honeywell equIP H4LGGR2', 'Honeywell equIP H4W2GR1', 'Honeywell equIP H4W2GR1V', 'Honeywell equIP H4W2GR2', 'Honeywell equIP H4W4GR1', 'Honeywell equIP H4W4GR1V', 'Honeywell equIP HBD8GR1', 'Honeywell equIP HBL2GR1', 'Honeywell equIP HBL2GR1V', 'Honeywell equIP HBL6GR2', 'Honeywell equIP HBW2GR1', 'Honeywell equIP HBW2GR1V', 'Honeywell equIP HBW2GR3', 'Honeywell equIP HBW2GR3V', 'Honeywell Performance HDZ302DIN-S1', 'Honeywell Performance HDZ302LIK', 'Honeywell Performance HDZ302LIW', 'Honeywell Performance HFD6GR1', 'Honeywell Performance HFD8GR1', 'Honeywell Performance HM4L8GR1', 'Honeywell Performance HMBL8GR1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-18230",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18230"
    }
  },
  "description": "Honeywell equIP H4L2GR1\u7b49\u90fd\u662f\u7f8e\u56fd\u970d\u5c3c\u97e6\u5c14\uff08Honeywell\uff09\u516c\u53f8\u7684\u4e00\u6b3eIP\u6444\u50cf\u673a\u3002\n\nHoneywell equIP\u7cfb\u5217\u548cPerformance\u7cfb\u5217IP\u6444\u50cf\u5934\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u672a\u6388\u6743\u8bbf\u95ee\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.honeywell.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-39763",
  "openTime": "2019-11-08",
  "patchDescription": "Honeywell equIP H4L2GR1\u7b49\u90fd\u662f\u7f8e\u56fd\u970d\u5c3c\u97e6\u5c14\uff08Honeywell\uff09\u516c\u53f8\u7684\u4e00\u6b3eIP\u6444\u50cf\u673a\u3002\r\n\r\nHoneywell equIP\u7cfb\u5217\u548cPerformance\u7cfb\u5217IP\u6444\u50cf\u5934\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u672a\u6388\u6743\u8bbf\u95ee\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Honeywell equIP\u7cfb\u5217\u548cPerformance\u7cfb\u5217IP\u6444\u50cf\u5934\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Honeywell equIP H3W2GR1",
      "Honeywell equIP H3W2GR1V",
      "Honeywell equIP H3W2GR2",
      "Honeywell equIP H3W4GR1",
      "Honeywell equIP H3W4GR1V",
      "Honeywell equIP H4D8GR1",
      "Honeywell equIP H4L2GR1V",
      "Honeywell equIP H4L6GR2",
      "Honeywell equIP H4LGGR2",
      "Honeywell equIP H4W2GR1",
      "Honeywell equIP H4W2GR1V",
      "Honeywell equIP H4W2GR2",
      "Honeywell equIP H4W4GR1",
      "Honeywell equIP H4W4GR1V",
      "Honeywell equIP HBD8GR1",
      "Honeywell equIP HBL2GR1",
      "Honeywell equIP HBL2GR1V",
      "Honeywell equIP HBL6GR2",
      "Honeywell equIP HBW2GR1",
      "Honeywell equIP HBW2GR1V",
      "Honeywell equIP HBW2GR3",
      "Honeywell equIP HBW2GR3V",
      "Honeywell Performance HDZ302DIN-S1",
      "Honeywell Performance HDZ302LIK",
      "Honeywell Performance HDZ302LIW",
      "Honeywell Performance HFD6GR1",
      "Honeywell Performance HFD8GR1",
      "Honeywell Performance HM4L8GR1",
      "Honeywell Performance HMBL8GR1"
    ]
  },
  "referenceLink": "https://www.us-cert.gov/ics/advisories/icsa-19-304-03\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-18230",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-31",
  "title": "Honeywell equIP\u7cfb\u5217\u548cPerformance\u7cfb\u5217IP\u6444\u50cf\u5934\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2019-18230 (GCVE-0-2019-18230)

Vulnerability from cvelistv5 – Published: 2019-10-31 21:15 – Updated: 2024-08-05 01:47

Summary

Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio streaming over HTTP.

Severity ?

No CVSS data available.

CWE

CWE-306

Assigner

icscert

References

URL

Tags

https://www.us-cert.gov/ics/advisories/icsa-19-304-03

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Honeywell equIP & Performance series IP cameras	Affected: equIP Camera,Vulnability fixed from version,H2W2GR1 1.000.0000.18.20190409,H3W2GR1 1.000.HW00.21.20190812,H3W2GR1V 1.000.0000.18.20190409,H3W2GR2 1.000.HW00.21.20190812,H3W4GR1 1.000.HW00.21.20190812,H3W4GR1V 1.000.0000.18.20190409,H4D8GR1 2.420.HW00.9.20180510,H4L2GR1 1.000.0000.18.20190423,H4L2GR1V 1.000.0000.18.20190423,H4L6GR2 1.000.HW02.8.20190813,H4LGGR2 .000.HW04.3.20190813,H4W2GR1 1.000.HW00.21.20190812,H4W2GR1V 1.000.0000.18.20190409,H4W2GR2 1.000.HW00.21.20190812,H4W4GR1 1.000.HW00.21.20190812,H4W4GR1V 1.000.0000.18.20190409,HBD8GR1 2.420.HW00.9.20180510,HBL2GR1 2.420.HW01.33.20190812,HBL2GR1V 1.000.0000.18.20190423,HBL6GR2 1.000.HW04.3.20190813,HBL6GR2 1.000.HW02.8.20190813,HBW2GR1 1.000.HW00.21.20190812, HBW2GR1V 1.000.0000.18.20190409,HBW2GR3 1.000.HW00.21.20190812,HBW2GR3V 1.000.0000.18.20190409,HBW4GR1 1.000.HW00.21.20190812, HBW4GR1V 1.000.0000.18.20190409,HCD8G 2.420.HW00.9.20180510,HCL2G 1.000.0000.18.20190423,HCL2GV 1.000.0000.18.20190423,HCW2G 1.000.HW00.21.20190812,HCW2GV ...[truncated*]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:47:14.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Honeywell equIP \u0026 Performance series IP cameras",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "equIP Camera,Vulnability fixed from version,H2W2GR1 1.000.0000.18.20190409,H3W2GR1 1.000.HW00.21.20190812,H3W2GR1V 1.000.0000.18.20190409,H3W2GR2 1.000.HW00.21.20190812,H3W4GR1 1.000.HW00.21.20190812,H3W4GR1V 1.000.0000.18.20190409,H4D8GR1 2.420.HW00.9.20180510,H4L2GR1 1.000.0000.18.20190423,H4L2GR1V 1.000.0000.18.20190423,H4L6GR2 1.000.HW02.8.20190813,H4LGGR2 .000.HW04.3.20190813,H4W2GR1 1.000.HW00.21.20190812,H4W2GR1V 1.000.0000.18.20190409,H4W2GR2 1.000.HW00.21.20190812,H4W4GR1 1.000.HW00.21.20190812,H4W4GR1V 1.000.0000.18.20190409,HBD8GR1 2.420.HW00.9.20180510,HBL2GR1 2.420.HW01.33.20190812,HBL2GR1V 1.000.0000.18.20190423,HBL6GR2 1.000.HW04.3.20190813,HBL6GR2 1.000.HW02.8.20190813,HBW2GR1 1.000.HW00.21.20190812, HBW2GR1V 1.000.0000.18.20190409,HBW2GR3 1.000.HW00.21.20190812,HBW2GR3V 1.000.0000.18.20190409,HBW4GR1 1.000.HW00.21.20190812, HBW4GR1V 1.000.0000.18.20190409,HCD8G 2.420.HW00.9.20180510,HCL2G 1.000.0000.18.20190423,HCL2GV 1.000.0000.18.20190423,HCW2G 1.000.HW00.21.20190812,HCW2GV  ...[truncated*]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio streaming over HTTP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-31T21:15:32",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-03"
        }
      ],
      "x_ConverterErrors": {
        "version_name": {
          "error": "version_name too long. Use array of versions to record more than one version.",
          "message": "Truncated!"
        }
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2019-18230",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Honeywell equIP \u0026 Performance series IP cameras",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "equIP Camera,Vulnability fixed from version,H2W2GR1 1.000.0000.18.20190409,H3W2GR1 1.000.HW00.21.20190812,H3W2GR1V 1.000.0000.18.20190409,H3W2GR2 1.000.HW00.21.20190812,H3W4GR1 1.000.HW00.21.20190812,H3W4GR1V 1.000.0000.18.20190409,H4D8GR1 2.420.HW00.9.20180510,H4L2GR1 1.000.0000.18.20190423,H4L2GR1V 1.000.0000.18.20190423,H4L6GR2 1.000.HW02.8.20190813,H4LGGR2 .000.HW04.3.20190813,H4W2GR1 1.000.HW00.21.20190812,H4W2GR1V 1.000.0000.18.20190409,H4W2GR2 1.000.HW00.21.20190812,H4W4GR1 1.000.HW00.21.20190812,H4W4GR1V 1.000.0000.18.20190409,HBD8GR1 2.420.HW00.9.20180510,HBL2GR1 2.420.HW01.33.20190812,HBL2GR1V 1.000.0000.18.20190423,HBL6GR2 1.000.HW04.3.20190813,HBL6GR2 1.000.HW02.8.20190813,HBW2GR1 1.000.HW00.21.20190812, HBW2GR1V 1.000.0000.18.20190409,HBW2GR3 1.000.HW00.21.20190812,HBW2GR3V 1.000.0000.18.20190409,HBW4GR1 1.000.HW00.21.20190812, HBW4GR1V 1.000.0000.18.20190409,HCD8G 2.420.HW00.9.20180510,HCL2G 1.000.0000.18.20190423,HCL2GV 1.000.0000.18.20190423,HCW2G 1.000.HW00.21.20190812,HCW2GV 1.000.0000.18.20190409,HCW4G 1.000.HW00.21.20190812,HDZ302D 1.000.0041.20180530,HDZ302DE 1.000.0041.20180530,HDZ302DIN 1.000.0041.20180530,HDZ302DIN-C1 1.000.0041.20180530,HDZ302DIN-S1 1.000.0041.20180530,HDZ302LIK 1.000.61.1.20180607,HDZ302LIW 1.000.61.1.20180607,HFD6GR1 1.000.HW00.9.20180510,HFD8GR1 1.000.HW00.9.20180510,HM4L8GR1 1.000.HW02.8.20190813,HMBL8GR1 1.000.HW02.8.20190813,Performance Series Vulnability fixed from version,H4D8PR1 1.000.HW01.3.20190820,HFD5PR1 1.000.HW01.1.20190822,HPW2P1 1.000.HW01.3.20190820,HDZP304DI 1.000.HW10.5.20190812,HDZP252DI 1.000.HW02.3.20181109"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio streaming over HTTP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-306"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsa-19-304-03",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-03"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2019-18230",
    "datePublished": "2019-10-31T21:15:32",
    "dateReserved": "2019-10-22T00:00:00",
    "dateUpdated": "2024-08-05T01:47:14.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-39763

CVE-2019-18230 (GCVE-0-2019-18230)

Tags

Sightings

Nomenclature