In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.
En IP-AK2 Access Control Panel Versión 1.04.07 y anteriores, el servidor web integrado de los dispositivos afectados podría permitir a atacantes remotos obtener datos de configuración web, que pueden ser accedidos sin autenticación a través de la red.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-306
|
| [email protected] | Primary |
en
CWE-306
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| honeywell | ip-ak2_firmware | * | <built-in method update of dict object at 0x7c3c2b035480> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:honeywell:ip-ak2_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:honeywell:ip-ak2:-:*:*:*:*:*:*:* |