CVE-2020-6960
CRITICALHoneywell MAXPRO VMS and NVR < 5.6 - Unauthenticated SQL Injection
Title source: llmDescription
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch contain an SQL injection vulnerability that could give an attacker remote unauthenticated access to the web user interface with administrator-level privileges.
References (1)
Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-021-01
Scores
CVSS v3
9.8
EPSS
0.0114
EPSS Percentile
63.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (6)
honeywell/hnmswvms_firmware
< vms560
honeywell/hnmswvmslt_firmware
< vms560
honeywell/maxpro_nvr_pe_firmware
< 5.6
honeywell/maxpro_nvr_se_firmware
< 5.6
honeywell/maxpro_nvr_xe_firmware
< 5.6
honeywell/mpnvrswxx_firmware
< 5.6
Published
Jan 22, 2020
Tracked Since
Feb 18, 2026