7.5
CVE-2021-39364
- EPSS 0.23%
- Veröffentlicht 24.02.2022 22:15:08
- Zuletzt bearbeitet 21.11.2024 06:19:25
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Honeywell ≫ Hdzp252di Firmware Version1.00.hw02.4
Honeywell ≫ Hbw2per1 Firmware Version1.000.hw01.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.433 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-294 Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).