Sign-up

ID

VAR-202001-1741


CVE

CVE-2020-6959


TITLE

MAXPRO VMS and NVR Product Unreliable Data Deserialization Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-001625

DESCRIPTION

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch are vulnerable to an unsafe deserialization of untrusted data. An attacker may be able to remotely modify deserialized data without authentication using a specially crafted web request, resulting in remote code execution. MAXPRO VMS and NVR The product contains a vulnerability in the deserialization of unreliable data.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Honeywell Maxpro VMS & NVR is a Honeywell security solution. Multiple Honeywell products have code problem vulnerabilities

Trust: 2.43

sources: NVD: CVE-2020-6959 // JVNDB: JVNDB-2020-001625 // CNVD: CNVD-2020-03940 // IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // VULMON: CVE-2020-6959

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // CNVD: CNVD-2020-03940

AFFECTED PRODUCTS

vendor:honeywellmodel:maxpro nvr sescope:lteversion:5.6

Trust: 1.0

vendor:honeywellmodel:maxpro nvr xescope:lteversion:5.6

Trust: 1.0

vendor:honeywellmodel:hnmswvmsltscope:lteversion:vms560

Trust: 1.0

vendor:honeywellmodel:hnmswvmsscope:lteversion:vms560

Trust: 1.0

vendor:honeywellmodel:maxpro nvr pescope:lteversion:5.6

Trust: 1.0

vendor:honeywellmodel:mpnvrswxxscope:lteversion:5.6

Trust: 1.0

vendor:honeywellmodel:hnmswvmsscope: - version: -

Trust: 0.8

vendor:honeywellmodel:hnmswvmsltscope: - version: -

Trust: 0.8

vendor:honeywellmodel:maxpro nvr pescope: - version: -

Trust: 0.8

vendor:honeywellmodel:maxpro nvr sescope: - version: -

Trust: 0.8

vendor:honeywellmodel:maxpro nvr xescope: - version: -

Trust: 0.8

vendor:honeywellmodel:mpnvrswxxscope: - version: -

Trust: 0.8

vendor:honeywellmodel:maxpro nvr xe <nvr build t2-patchscope:eqversion:5.6595

Trust: 0.6

vendor:honeywellmodel:maxpro nvr se <nvr build t2-patchscope:eqversion:5.6595

Trust: 0.6

vendor:honeywellmodel:maxpro nvr pe <nvr build t2-patchscope:eqversion:5.6595

Trust: 0.6

vendor:honeywellmodel:mpnvrswxx <nvr build t2-patchscope:eqversion:5.6595

Trust: 0.6

vendor:maxpro nvr xemodel: - scope:eqversion:*

Trust: 0.2

vendor:maxpro nvr semodel: - scope:eqversion:*

Trust: 0.2

vendor:maxpro nvr pemodel: - scope:eqversion:*

Trust: 0.2

vendor:mpnvrswxxmodel: - scope:eqversion:*

Trust: 0.2

vendor:hnmswvmsmodel: - scope:eqversion:*

Trust: 0.2

vendor:hnmswvmsltmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // CNVD: CNVD-2020-03940 // JVNDB: JVNDB-2020-001625 // NVD: CVE-2020-6959

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-6959
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2020-001625
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-03940
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202001-962
value: CRITICAL

Trust: 0.6

IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718
value: HIGH

Trust: 0.2

VULMON: CVE-2020-6959
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-6959
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-001625
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-03940
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2020-6959
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-001625
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // CNVD: CNVD-2020-03940 // VULMON: CVE-2020-6959 // JVNDB: JVNDB-2020-001625 // CNNVD: CNNVD-202001-962 // NVD: CVE-2020-6959

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.8

sources: JVNDB: JVNDB-2020-001625 // NVD: CVE-2020-6959

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-962

TYPE

Code problem

Trust: 0.8

sources: IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // CNNVD: CNNVD-202001-962

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-001625

PATCH
title:Top Pageurl:https://www.honeywell.com/
Trust: 0.8
title:Patch for Multiple Honeywell Product Code Issue Vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/199335
Trust: 0.6
title:Multiple Honeywell Product code issue vulnerability fixesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=109235
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-03940 // 
            
            
            
            JVNDB: JVNDB-2020-001625 // 
            
            
            
            CNNVD: CNNVD-202001-962

EXTERNAL IDS
db:NVDid:CVE-2020-6959
Trust: 3.3
db:ICS CERTid:ICSA-20-021-01
Trust: 3.1
db:CNVDid:CNVD-2020-03940
Trust: 0.8
db:CNNVDid:CNNVD-202001-962
Trust: 0.8
db:JVNDBid:JVNDB-2020-001625
Trust: 0.8
db:AUSCERTid:ESB-2020.0265
Trust: 0.6
db:IVDid:AC26C1BF-8A71-462D-85A2-2060CB9F6718
Trust: 0.2
db:VULMONid:CVE-2020-6959
Trust: 0.1
sources:
            
            
            IVD: ac26c1bf-8a71-462d-85a2-2060cb9f6718 // 
            
            
            
            CNVD: CNVD-2020-03940 // 
            
            
            
            VULMON: CVE-2020-6959 // 
            
            
            
            JVNDB: JVNDB-2020-001625 // 
            
            
            
            CNNVD: CNNVD-202001-962 // 
            
            
            
            NVD: CVE-2020-6959

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsa-20-021-01
Trust: 3.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-6959
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6959
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2020.0265/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/502.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-03940 // 
            
            
            
            VULMON: CVE-2020-6959 // 
            
            
            
            JVNDB: JVNDB-2020-001625 // 
            
            
            
            CNNVD: CNNVD-202001-962 // 
            
            
            
            NVD: CVE-2020-6959

SOURCES
db:IVDid:ac26c1bf-8a71-462d-85a2-2060cb9f6718
db:CNVDid:CNVD-2020-03940
db:VULMONid:CVE-2020-6959
db:JVNDBid:JVNDB-2020-001625
db:CNNVDid:CNNVD-202001-962
db:NVDid:CVE-2020-6959

LAST UPDATE DATE
2024-11-23T22:33:36.069000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-03940date:2020-02-06T00:00:00
db:VULMONid:CVE-2020-6959date:2020-02-05T00:00:00
db:JVNDBid:JVNDB-2020-001625date:2020-02-19T00:00:00
db:CNNVDid:CNNVD-202001-962date:2023-05-17T00:00:00
db:NVDid:CVE-2020-6959date:2024-11-21T05:36:23.380

SOURCES RELEASE DATE
db:IVDid:ac26c1bf-8a71-462d-85a2-2060cb9f6718date:2020-01-21T00:00:00
db:CNVDid:CNVD-2020-03940date:2020-02-06T00:00:00
db:VULMONid:CVE-2020-6959date:2020-01-22T00:00:00
db:JVNDBid:JVNDB-2020-001625date:2020-02-19T00:00:00
db:CNNVDid:CNNVD-202001-962date:2020-01-21T00:00:00
db:NVDid:CVE-2020-6959date:2020-01-22T15:15:11.270