CVE-2023-1841 - CVE House

Back to Database

Status published High CVE-2023-1841

Honeywell MPA2 Web Application XSS vulnerability

8.1 CVSS

Vulnerability Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability. This version and all later versions correct the reported vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1841

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Ken Pyle from CYBIR (kp@cybir.com)

References

More from Honeywell

View All →

Integer underflow during processing of short network packets in CDA FTEB responder

Incorrect response generation during FTEB protocol processing

Authenticated command injection

Lack of buffer clearing before reuse may result in incorrect system behavior.

Lack of buffer clearing before reuse may result in incorrect system behavior.

Affected Vendor

Honeywell

View all reports →

Affected Software

MPA2 Access Panel

Vulnerable Versions:

0

Timeline

Official Publish: February 29th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement