CVE-2020-6974 - Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories

Back Back to CVE browser

CRITICAL

Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories

Published Apr 7, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.90%

Description

Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem.

Affected products

Vendor n/a Product Honeywell Notifier Web Server (NWS) Default
unknown
Affected
- Version 3.50 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Honeywell Notifier Web Server (NWS)	unknown	Affected Version 3.50 and earlier

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28114
Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-051-03
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28114		Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-051-03		x_refsource_MISCThird Party AdvisoryUS Government Resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Apr 7, 2020

Updated Aug 4, 2024

Reserved Jan 14, 2020

Link CVE-2020-6974

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-6974

Red Hat

No data

ENISA EUVD

Assigner icscert

Published Apr 7, 2020

Updated Aug 4, 2024

Link EUVD-2020-28114

GitHub

No data