Honeywell Performance IP Cameras and Performance NVRs

Honeywell Performance IP Series cameras and NVRs contain an information disclosure vulnerability that allows an unauthenticated attacker to view sensitive device configuration information without authentication. The vulnerability affects 60+ camera models across multiple form factors (dome, turret, and bullet cameras). An attacker on the network—or from the Internet if the camera is directly exposed—can query the device for configuration details that may reveal network topology, settings, or operational information useful for reconnaissance. The vulnerability has a CVSS score of 5.3 (medium) and requires only network access with no authentication. No public exploits currently exist. Honeywell has released firmware updates for affected devices, though some older models may no longer receive updates.