CVE-2020-6972

In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser.

Score

CVSS 3.1 9.1 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2020-03-24

Last modified

2024-08-04

Weaknesses

CWE-294

Affected products

• Notifier Web Server Nws Version 3.50 And Earlier (Honeywell)
• Notifier Webserver (Honeywell)

References

• https://www.us-cert.gov/ics/advisories/icsa-20-051-03