critical9.8
CVE-2020-6960
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-P…
Impact
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch contain an SQL injection vulnerability that could give an attacker remote unauthenticated access to the web user interface with administrator-level privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Honeywell | Maxpro Nvr Xe Firmware | through 5.6 |
| Honeywell | Maxpro Nvr Se Firmware | through 5.6 |
| Honeywell | Maxpro Nvr Pe Firmware | through 5.6 |
| Honeywell | Mpnvrswxx Firmware | through 5.6 |
| Honeywell | Hnmswvms Firmware | through vms560 |
| Honeywell | Hnmswvmslt Firmware | through vms560 |