Multiple vulnerabilities in Honeywell WIN-PAK
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2020-7005 CVE-2020-6982 CVE-2020-6978 |
| CWE-ID | CWE-352 CWE-644 CWE-477 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
WIN-PAK Client/Desktop applications / Other client software |
| Vendor | Honeywell International, Inc |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Cross-site request forgery
EUVDB-ID: #VU25605
Risk: Low
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-7005
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWIN-PAK: 4.7.2
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-056-05
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper Neutralization of HTTP Headers for Scripting Syntax
EUVDB-ID: #VU25606
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-6982
CWE-ID:
CWE-644 - Improper Neutralization of HTTP Headers for Scripting Syntax
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers. A remote attacker on the local network can execute arbitrary code on the system.
Install updates from vendor's website.
Vulnerable software versionsWIN-PAK: 4.7.2
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-056-05
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Use of Obsolete Function
EUVDB-ID: #VU25607
Risk: Medium
CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-6978
CWE-ID:
CWE-477 - Use of Obsolete Function
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to due to the usage of old jQuery libraries. A remote attacker can execute arbitrary code on the target system. A remote attacker can bypass certain security restrictions.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWIN-PAK: 4.7.2
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-056-05
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
