Harman
Products
9- 6 CVEs
- 3 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 0 CVEs
Recent CVEs
14| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-1984 | Cri | 0.64 | 9.8 | 0.04 | Jan 22, 2016 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2015-8362. | ||
| CVE-2015-8362 | Cri | 0.64 | 9.8 | 0.05 | Jan 22, 2016 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984. | ||
| CVE-2019-11224 | Hig | 0.58 | 8.8 | 0.07 | May 15, 2019 | HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection. | ||
| CVE-2023-40293 | Med | 0.44 | 6.8 | 0.02 | Aug 14, 2023 | Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object. | ||
| CVE-2023-40291 | Med | 0.44 | 6.8 | 0.01 | Aug 14, 2023 | Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name. | ||
| CVE-2024-2105 | Med | 0.42 | 6.5 | 0.00 | Dec 10, 2025 | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices. | ||
| CVE-2023-38523 | Med | 0.35 | 5.3 | 0.01 | Jul 20, 2023 | The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115… | ||
| CVE-2019-19562 | Med | 0.30 | 4.6 | 0.01 | Nov 16, 2020 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information. | ||
| CVE-2019-19560 | Med | 0.30 | 4.6 | 0.01 | Nov 16, 2020 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system information. | ||
| CVE-2019-19556 | Med | 0.30 | 4.6 | 0.00 | Nov 16, 2020 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information. | ||
| CVE-2023-40292 | Med | 0.28 | 4.3 | 0.01 | Aug 14, 2023 | Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets. | ||
| CVE-2019-19563 | Low | 0.16 | 2.4 | 0.00 | Nov 16, 2020 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information. | ||
| CVE-2019-19561 | Low | 0.16 | 2.4 | 0.00 | Nov 16, 2020 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information. | ||
| CVE-2019-19557 | Low | 0.16 | 2.4 | 0.00 | Nov 16, 2020 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information. |
- risk 0.64cvss 9.8epss 0.04
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2015-8362.
- risk 0.64cvss 9.8epss 0.05
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984.
- risk 0.58cvss 8.8epss 0.07
HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
- risk 0.44cvss 6.8epss 0.02
Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
- risk 0.44cvss 6.8epss 0.01
Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name.
- risk 0.42cvss 6.5epss 0.00
An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.
- risk 0.35cvss 5.3epss 0.01
The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115…
- risk 0.30cvss 4.6epss 0.01
An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information.
- risk 0.30cvss 4.6epss 0.01
An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system information.
- risk 0.30cvss 4.6epss 0.00
An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information.
- risk 0.28cvss 4.3epss 0.01
Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.
- risk 0.16cvss 2.4epss 0.00
A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
- risk 0.16cvss 2.4epss 0.00
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
- risk 0.16cvss 2.4epss 0.00
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.