PT-2020-19322 · Honeywell · Honeywell Notifier Web Server

Published 2020-04-07 · Updated 2020-04-09 · CVE-2020-6974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Honeywell Notifier Web Server (NWS) version 3.50

Description The issue allows an attacker to bypass access to restricted directories through a path traversal attack. Honeywell has released a firmware update to address the problem.

Recommendations For Honeywell Notifier Web Server (NWS) version 3.50, apply the firmware update released by Honeywell to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-6974

Affected Products

Honeywell Notifier Web Server

References · 4

• https://osv.dev/vulnerability/CVE-2020-6974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6974 · Security Note
• https://us-cert.gov/ics/advisories/icsa-20-051-03 · Note
• https://t.me/cvenotify/2509 · Telegram Post