CVE-2021-39364

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

1.05%

Published

Feb 24, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-294

Affected Products (4)

honeywell · hdzp252di_firmwarevulnerable

honeywell · hdzp252di

honeywell · hbw2per1_firmwarevulnerable

honeywell · hbw2per1

References (6)

https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_Video_Replay_HBW2PER1.pdf

Vendor Advisory

https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices

Vendor Advisory

https://www.honeywell.com/us/en/product-security

Vendor Advisory

https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_Video_Replay_HBW2PER1.pdf

Vendor Advisory

https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices

Vendor Advisory

https://www.honeywell.com/us/en/product-security

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs