Honeywell Notifier Webserver vulnerabilities

2 CVEs affecting Honeywell Notifier Webserver, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-6974, published 2020-04-07.

More from Honeywell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-6974, published 2020-04-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware…
• CVE-2020-6972, published 2020-03-24. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser.