CVE-2023-1841

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability. This version and all later versions correct the reported vulnerability.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices	Vendor Advisory
https://https://www.honeywell.com/us/en/product-security	Vendor Advisory
https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices	Vendor Advisory
https://https://www.honeywell.com/us/en/product-security	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:honeywell:mpa2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:mpa2:*:*:*:*:*:*:*:*

History

04 Mar 2025, 12:25

Type	Values Removed	Values Added
References	~~() https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices -~~	() https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices - Vendor Advisory
References	~~() https://https://www.honeywell.com/us/en/product-security -~~	() https://https://www.honeywell.com/us/en/product-security - Vendor Advisory
CPE		cpe:2.3:o:honeywell:mpa2_firmware:::::::: cpe:2.3:h:honeywell:mpa2::::::::
First Time		Honeywell Honeywell mpa2 Firmware Honeywell mpa2

Information

Published : 2024-02-29 06:15

Updated : 2025-03-04 12:25

NVD link : CVE-2023-1841

Mitre link : CVE-2023-1841

CVE.ORG link : CVE-2023-1841

JSON object : View

Products Affected

honeywell

mpa2
mpa2_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-1841", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-02-29T06:15:45.093", "references": [{"url": "https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}, {"url": "https://https://www.honeywell.com/us/en/product-security", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}, {"url": "https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://https://www.honeywell.com/us/en/product-security", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05.\u00a0\n\nHoneywell released firmware update package MPA2 firmware\u00a0R1.00.08.05 which addresses\u00a0this vulnerability. This version and all later versions\ncorrect the reported vulnerability.\n\n"}, {"lang": "es", "value": "La vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('cross-site Scripting') en Honeywell MPA2 Access Panel (m\u00f3dulos de servidor web) permite que XSS utilice caracteres no v\u00e1lidos. Este problema afecta a MPA2 Access Panel en todas las versiones anteriores a R1.00.08.05. Honeywell lanz\u00f3 el paquete de actualizaci\u00f3n de firmware MPA2 R1.00.08.05 que soluciona esta vulnerabilidad. Esta versi\u00f3n y todas las versiones posteriores corrigen la vulnerabilidad informada."}], "lastModified": "2025-03-04T12:25:10.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:mpa2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAF764CE-1B5E-4BB1-B431-61F506797CCA", "versionEndExcluding": "R1.00.08.05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:mpa2:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "79B6F95D-6F2A-46FA-8A45-BF8737AA1DCA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}