CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-14263

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user account to fully control the device.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.244

EPSS Ranking 95.8%

CVSS Severity

CVSS v3 Score 8.1

CVSS v2 Score 9.3

References

Products affected by CVE-2017-14263

Honeywell » Enterprise Dvr » Version: N/A

cpe:2.3:h:honeywell:enterprise_dvr:-
Honeywell » Fusion Iv Rev C » Version: N/A

cpe:2.3:h:honeywell:fusion_iv_rev_c:-
Honeywell » Maxpro Nvr Hybrid Se » Version: N/A

cpe:2.3:h:honeywell:maxpro_nvr_hybrid_se:-
Honeywell » Maxpro Nvr Hybrid Xe » Version: N/A

cpe:2.3:h:honeywell:maxpro_nvr_hybrid_xe:-
Honeywell » Maxpro Nvr Pe » Version: N/A

cpe:2.3:h:honeywell:maxpro_nvr_pe:-
Honeywell » Maxpro Nvr Se » Version: N/A

cpe:2.3:h:honeywell:maxpro_nvr_se:-
Honeywell » Maxpro Nvr Xe » Version: N/A

cpe:2.3:h:honeywell:maxpro_nvr_xe:-
Honeywell » Enterprise Dvr Firmware » Version: N/A

cpe:2.3:o:honeywell:enterprise_dvr_firmware:-
Honeywell » Fusion Iv Rev C Firmware » Version: N/A

cpe:2.3:o:honeywell:fusion_iv_rev_c_firmware:-
Honeywell » Maxpro Nvr Hybrid Se Firmware » Version: N/A

cpe:2.3:o:honeywell:maxpro_nvr_hybrid_se_firmware:-
Honeywell » Maxpro Nvr Hybrid Xe Firmware » Version: N/A

cpe:2.3:o:honeywell:maxpro_nvr_hybrid_xe_firmware:-
Honeywell » Maxpro Nvr Pe Firmware » Version: N/A

cpe:2.3:o:honeywell:maxpro_nvr_pe_firmware:-
Honeywell » Maxpro Nvr Se Firmware » Version: N/A

cpe:2.3:o:honeywell:maxpro_nvr_se_firmware:-
Honeywell » Maxpro Nvr Xe Firmware » Version: N/A

cpe:2.3:o:honeywell:maxpro_nvr_xe_firmware:-

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-14263

Products

Pricing

Contact Us