PT-2024-11943 · Honeywell · Honeywell Mpa2 Access Panel

Ken Pyle · Published 2024-02-28 · Updated 2025-03-04 · CVE-2023-1841

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Honeywell MPA2 Access Panel versions prior to R1.00.08.05

Description The issue is related to improper neutralization of input during web page generation, which allows cross-site scripting (XSS) using invalid characters. This can be exploited through the web server modules of the Honeywell MPA2 Access Panel.

Recommendations For versions prior to R1.00.08.05, update to firmware version R1.00.08.05 or later to resolve the issue. As a temporary workaround, consider restricting access to the web server modules until the update can be applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1841

Affected Products

Honeywell Mpa2 Access Panel

References · 8

• https://osv.dev/vulnerability/CVE-2023-1841 · Vendor Advisory
• https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices · Vendor Advisory
• https://https//www.honeywell.com/us/en/product-security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1841 · Security Note
• https://twitter.com/CVEnew/status/1763074168633893107 · Twitter Post
• https://t.me/cvenotify/72652 · Telegram Post
• https://t.me/cvenotify/78016 · Telegram Post
• https://t.me/cvenotify/113348 · Telegram Post