Honeywell has released patches for a couple of potentially serious vulnerabilities affecting a web server used by its Notifier fire alarm systems.
Gjoko Krstic, researcher at industrial cybersecurity firm Applied Risk, discovered that the NOTI-FIRE-NET Web Server (NWS-3) is affected by authorization bypass (CVE-2020-6972) and information disclosure vulnerabilities (CVE-2020-6974).
The NOTI-FIRE-NET interface allows organizations to connect multiple intelligent fire alarm control panels to one network. The web server enables remote access to this network, allowing users to see event history and status, device properties and other information.
Krstic discovered that the web server is affected by a security hole that allows an unauthenticated attacker to bypass the system’s authentication mechanism by intercepting the server’s response and changing the response message from “FAILURE” to “SUCCESS.” This would give the attacker access to the admin dashboard and the alarm system’s functionality.
Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s 2020 ICS Cyber Security Conference
The second vulnerability is related to the existence of a database backup file that is generated with a predictable name. An unauthenticated attacker can download this database file, which includes sensitive information, such as usernames and password hashes. With this information at hand, the attacker can gain full access to the fire alarm system.
Krstic told SecurityWeek that a Shodan search revealed six instances of the Notifier fire alarm web server exposed to the internet.
While the advisory published on Monday by Applied Risk classifies the vulnerabilities as medium and high severity, the advisories from the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) and Honeywell rate both flaws as critical.
Honeywell has released firmware update 4.51 to patch the vulnerabilities. Krstic said the update was released roughly four months after the initial contact, but he has not tested the patches.
In addition to releasing patches, Honeywell has advised users to isolate their systems from the internet, use VPNs when remote connections are required, and set strong passwords.
Related: Serious Vulnerabilities Expose Honeywell Surveillance Systems to Attacks
Related: Researcher Finds Over 60 Vulnerabilities in Physical Security Systems