CVE-2021-39364

Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.

• CWE-294

• https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_Video_Replay_HBW2PER1.pdfVendor Advisory
• https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-noticesVendor Advisory
• https://www.honeywell.com/us/en/product-securityVendor Advisory
• https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_Video_Replay_HBW2PER1.pdfVendor Advisory
• https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-noticesVendor Advisory
• https://www.honeywell.com/us/en/product-securityVendor Advisory

Published

Feb 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39358In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does no…5.9
• CVE-2021-39359In GNOME libgda through 6.0.0, gda-web-provider.c does not e…5.9
• CVE-2021-39360In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not e…5.9
• CVE-2021-39361In GNOME evolution-rss through 0.3.96, network-soup.c does n…5.9
• CVE-2021-39362An XSS issue was discovered in ReCaptcha Solver 5.7. A respo…6.1
• CVE-2021-39363Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 de…9.8
• CVE-2021-39365In GNOME grilo though 0.3.13, grl-net-wc.c does not enable T…5.9
• CVE-2021-39367Canon Oce Print Exec Workgroup 1.3.2 allows Host header inje…5.3
• CVE-2021-39368Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang…6.1
• CVE-2021-39369In Philips (formerly Carestream) Vue MyVue PACS through 12.2…6.5
• CVE-2021-3937Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-39371An XML external entity (XXE) injection in PyWPS before 4.4.5…7.5