Honeywell has released patches for a couple of potentially serious vulnerabilities affecting a web server used by its Notifier fire alarm systems.
Gjoko Krstic, researcher at industrial cybersecurity firm Applied Risk, discovered that the NOTI-FIRE-NET Web Server (NWS-3) is affected by authorization bypass (CVE-2020-6972) and information disclosure vulnerabilities (CVE-2020-6974).
The NOTI-FIRE-NET interface allows organizations to connect multiple intelligent fire alarm control panels to one network. The web server enables remote access to this network, allowing users to see event history and status, device properties and other information.
Krstic discovered that the web server is affected by a security hole that allows an unauthenticated attacker to bypass the system’s authentication mechanism by intercepting the server’s response and changing the response message from “FAILURE” to “SUCCESS.” This would give the attacker access to the admin dashboard and the alarm system’s functionality.
Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s 2020 ICS Cyber Security Conference
The second vulnerability is related to the existence of a database backup file that is generated with a predictable name. An unauthenticated attacker can download this database file, which includes sensitive information, such as usernames and password hashes. With this information at hand, the attacker can gain full access to the fire alarm system.
Krstic told SecurityWeek that a Shodan search revealed six instances of the Notifier fire alarm web server exposed to the internet.
While the advisory published on Monday by Applied Risk classifies the vulnerabilities as medium and high severity, the advisories from the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) and Honeywell rate both flaws as critical.
Honeywell has released firmware update 4.51 to patch the vulnerabilities. Krstic said the update was released roughly four months after the initial contact, but he has not tested the patches.
In addition to releasing patches, Honeywell has advised users to isolate their systems from the internet, use VPNs when remote connections are required, and set strong passwords.
Related: Serious Vulnerabilities Expose Honeywell Surveillance Systems to Attacks
Related: Researcher Finds Over 60 Vulnerabilities in Physical Security Systems
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
Latest News
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
