Vulnerability · Published Feb 29, 2024 · Assigned by Honeywell

CVE-2023-1841Honeywell MPA2 Web Application XSS vulnerability

High 8.1

In plain English

A high-severity cross-site scripting in MPA2 Access Panel from Honeywell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 68.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability. This version and all later versions correct the reported vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Honeywell	MPA2 Access Panel	0 – before R1.00.08.05

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References