CRITICAL: CVE-2020-6960 (CVSS 9.8) — honeywell maxpro nvr xe firmware

CVE: CVE-2020-6960

CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: CRITICAL

Status: Critical advisory

Affected

• honeywell maxpro nvr xe firmware
• honeywell maxpro nvr xe
• honeywell maxpro nvr se firmware
• honeywell maxpro nvr se
• honeywell maxpro nvr pe firmware

Summary

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch contain an SQL injection vulnerability that could give an attacker remote unauthenticated access to the web user interface with administrator-level privileges.

Verified Sources

• NVD entry
• GitHub Advisory
• MITRE

References

• https://www.us-cert.gov/ics/advisories/icsa-20-021-01
• https://www.us-cert.gov/ics/advisories/icsa-20-021-01

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._