CVE-2020-6972 - OpenCVE

In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Honeywell	Notifier Webserver

Configuration 1 [-]

cpe:2.3:a:honeywell:notifier_webserver:*:*:*:*:*:*:*:*

References

Link	Resource
https://www.us-cert.gov/ics/advisories/icsa-20-051-03	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2020-03-24T16:38:57

Updated: 2020-03-24T16:38:57

Reserved: 2020-01-14T00:00:00

Link: CVE-2020-6972

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-03-24T17:15:11.467

Modified: 2020-03-27T19:46:47.987

Link: CVE-2020-6972

JSON object: View

Redhat Information

No data.

CWE

CWE-294

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:honeywell:notifier_webserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "9096B70A-79EC-4235-91F2-48D52246272F", "versionEndIncluding": "3.50", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server\u2019s authentication may be bypassed by a capture-replay attack from a web browser."}, {"lang": "es", "value": "En Notifier Web Server (NWS) versiones 3.50 y anteriores, la autenticaci\u00f3n del Honeywell Fire Web Server puede ser omitida por un ataque de reproducci\u00f3n de captura desde un navegador web."}], "id": "CVE-2020-6972", "lastModified": "2020-03-27T19:46:47.987", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-24T17:15:11.467", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-294"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}