CVEvulnerability

CVE-2017-14263

8.1 HIGH Published 2017-09-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-384

Description

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user account to fully control the device.

Affected configurations

• honeywell enterprise dvr firmware • honeywell maxpro nvr hybrid se firmware • honeywell maxpro nvr hybrid xe firmware • honeywell maxpro nvr se firmware • honeywell maxpro nvr xe firmware • honeywell fusion iv rev c firmware • honeywell maxpro nvr pe firmware

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References