Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Vulnerabilities Allow Hackers to Access Honeywell Fire Alarm Systems

Honeywell has released patches for a couple of potentially serious vulnerabilities affecting a web server used by its Notifier fire alarm systems.

Honeywell has released patches for a couple of potentially serious vulnerabilities affecting a web server used by its Notifier fire alarm systems.

Gjoko Krstic, researcher at industrial cybersecurity firm Applied Risk, discovered that the NOTI-FIRE-NET Web Server (NWS-3) is affected by authorization bypass (CVE-2020-6972) and information disclosure vulnerabilities (CVE-2020-6974).

The NOTI-FIRE-NET interface allows organizations to connect multiple intelligent fire alarm control panels to one network. The web server enables remote access to this network, allowing users to see event history and status, device properties and other information.

Krstic discovered that the web server is affected by a security hole that allows an unauthenticated attacker to bypass the system’s authentication mechanism by intercepting the server’s response and changing the response message from “FAILURE” to “SUCCESS.” This would give the attacker access to the admin dashboard and the alarm system’s functionality.

Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s 2020 ICS Cyber Security Conference

The second vulnerability is related to the existence of a database backup file that is generated with a predictable name. An unauthenticated attacker can download this database file, which includes sensitive information, such as usernames and password hashes. With this information at hand, the attacker can gain full access to the fire alarm system.

Krstic told SecurityWeek that a Shodan search revealed six instances of the Notifier fire alarm web server exposed to the internet.

While the advisory published on Monday by Applied Risk classifies the vulnerabilities as medium and high severity, the advisories from the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) and Honeywell rate both flaws as critical.

Honeywell has released firmware update 4.51 to patch the vulnerabilities. Krstic said the update was released roughly four months after the initial contact, but he has not tested the patches.

In addition to releasing patches, Honeywell has advised users to isolate their systems from the internet, use VPNs when remote connections are required, and set strong passwords.

Related: Serious Vulnerabilities Expose Honeywell Surveillance Systems to Attacks

Related: Researcher Finds Over 60 Vulnerabilities in Physical Security Systems

Related: Serious Flaws Found in Honeywell Gas Detectors

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.