CVE-2019-13523

https://notcve.org/view.php?id=CVE-2019-13523

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L. En las cámaras IP y NVRs Honeywell Performance, el servidor web integrado de los dispositivos afectados podría permitir a atacantes remotos obtener datos de configuración web en formato JSON para cámaras IP y NVR (Network Video Recorders), que pueden ser accedidos sin autenticación a través de la red. Cámaras IP Performance afectadas: HBD3PR2, H4D3PRV3, HED3PR3, H4D3PRV2, HBD3PR1, H4W8PR2, HBW8PR2, H2W2PC1M, H2W4PER3, H2W2PER3, HEW2PER3, HEW4PER3B, HBW2PER1, HEW4PER2, HEW4PER2B, HEW2PER2, H4W2PER2, HBW2PER2, H4W2PER3, y HPW2P1. • https://www.us-cert.gov/ics/advisories/icsa-19-260-03 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-306: Missing Authentication for Critical Function •