CVE-2019-18230

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-31 · updated 2026-06-17
Weakness: CWE-306

Description

Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio streaming over HTTP.

Affected products

Honeywell H2W2Gr1 Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell H3W2Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H3W2Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell H3W2Gr2 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H3W4Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H3W4Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell H4D8Gr1 Firmware: before 2.420.hw00.9.20180510 — fixed in 2.420.hw00.9.20180510
Honeywell H4D8Pr1 Firmware: before 1.000.hw01.3.20190820 — fixed in 1.000.hw01.3.20190820
Honeywell H4L2Gr1 Firmware: before 1.000.0000.18.20190423 — fixed in 1.000.0000.18.20190423
Honeywell H4L2Gr1V Firmware: before 1.000.0000.18.20190423 — fixed in 1.000.0000.18.20190423
Honeywell H4L6Gr2 Firmware: before 1.000.hw02.8.20190813 — fixed in 1.000.hw02.8.20190813
Honeywell H4Lggr2 Firmware: before 1.000.hw04.3.20190813 — fixed in 1.000.hw04.3.20190813
Honeywell H4W2Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H4W2Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell H4W2Gr2 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H4W4Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell H4W4Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell Hbd8Gr1 Firmware: before 2.420.hw00.9.20180510 — fixed in 2.420.hw00.9.20180510
Honeywell Hbl2Gr1 Firmware: before 2.420.hw01.33.20190812 — fixed in 2.420.hw01.33.20190812
Honeywell Hbl2Gr1V Firmware: before 1.000.0000.18.20190423 — fixed in 1.000.0000.18.20190423
Honeywell Hbl6Gr2 Firmware: before 1.000.hw04.3.20190813; before 1.000.hw02.8.20190813 — fixed in 1.000.hw02.8.20190813, 1.000.hw04.3.20190813
Honeywell Hbw2Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell Hbw2Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell Hbw2Gr3 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell Hbw2Gr3V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell Hbw4Gr1 Firmware: before 1.000.hw00.21.20190812 — fixed in 1.000.hw00.21.20190812
Honeywell Hbw4Gr1V Firmware: before 1.000.0000.18.20190409 — fixed in 1.000.0000.18.20190409
Honeywell Hcd8G Firmware: before 2.420.hw00.9.20180510 — fixed in 2.420.hw00.9.20180510
Honeywell Hcl2G Firmware: before 1.000.0000.18.20190423 — fixed in 1.000.0000.18.20190423
Honeywell Hcl2Gv Firmware: before 1.000.0000.18.20190423 — fixed in 1.000.0000.18.20190423

How to fix

Upgrade to a fixed version: Honeywell H2W2Gr1 Firmware 1.000.0000.18.20190409; Honeywell H3W2Gr1 Firmware 1.000.hw00.21.20190812; Honeywell H3W2Gr1V Firmware 1.000.0000.18.20190409; Honeywell H3W2Gr2 Firmware 1.000.hw00.21.20190812; Honeywell H3W4Gr1 Firmware 1.000.hw00.21.20190812; Honeywell H3W4Gr1V Firmware 1.000.0000.18.20190409; Honeywell H4D8Gr1 Firmware 2.420.hw00.9.20180510; Honeywell H4D8Pr1 Firmware 1.000.hw01.3.20190820; Honeywell H4L2Gr1 Firmware 1.000.0000.18.20190423; Honeywell H4L2Gr1V Firmware 1.000.0000.18.20190423; Honeywell H4L6Gr2 Firmware 1.000.hw02.8.20190813; Honeywell H4Lggr2 Firmware 1.000.hw04.3.20190813. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-18230 or the next vulnerability affects your stack