Honeywell MPA2 Access Panel Vulnerable to Cross-site Scripting Attacks
CVE-2023-1841

4.8MEDIUM

Key Information:

Vendor

Honeywell

Status
Mpa2 Access Panel
Vendor
CVE Published:
29 February 2024

What is CVE-2023-1841?

An improperly neutralized input issue has been identified within the web server modules of the Honeywell MPA2 Access Panel, leading to a cross-site scripting (XSS) vulnerability. This flaw permits attackers to inject malicious scripts during web page generation by exploiting invalid characters. All versions of the MPA2 Access Panel prior to R1.00.08.05 are susceptible to this security risk. Users are advised to upgrade to firmware version R1.00.08.05 or later to mitigate this vulnerability effectively. The latest firmware rectifies the reported issue and enhances overall security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MPA2 Access Panel 0

References

https://buildings.honeywell.com/us/en/brands/our-brands/s...
https://https://www.honeywell.com/us/en/product-security

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ken Pyle from CYBIR (kp@cybir.com)
JSON
.