Lucene search

IcscertCVE-2019-13525

HistoryOct 25, 2019 - 6:15 p.m.

CVE-2019-13525

2019-10-2518:15:10

CWE-306

icscert

web.nvd.nist.gov

138

ip-ak2

access control panel

cve-2019-13525

security vulnerability

web server

authentication

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

48.3%

JSON

In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.

Affected configurations

Nvd

Node

honeywellip-ak2Match-

AND

honeywellip-ak2_firmwareRange<1.04.07

VendorProductVersionCPE
honeywellip-ak2-cpe:2.3:h:honeywell:ip-ak2:-:*:*:*:*:*:*:*
honeywellip-ak2_firmware*cpe:2.3:o:honeywell:ip-ak2_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
honeywell	ip-ak2	-	cpe:2.3:h:honeywell:ip-ak2:-:::::::*
honeywell	ip-ak2_firmware	*	cpe:2.3:o:honeywell:ip-ak2_firmware::::::::

CNA Affected

[
  {
    "product": "Honeywell IP-AK2",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "IP-AK2 Access Control Panel Version 1.04.07 and prior"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-19-297-02

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

48.3%

JSON

Related for CVE-2019-13525