High ICSA-20-056-05 3 CVEs

Honeywell WIN-PAK

Published Feb 25, 2020 · Updated Feb 25, 2020

Vendor: Honeywell Product: WIN-PAK

Summary

Successful exploitation of these vulnerabilities allows an attacker to perform remote code execution.

Vulnerabilities 3

Unscored —

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery l…

Mar 24, 2020
Unscored —

CVE-2020-6982

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may a…

Mar 24, 2020
Unscored —

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery,…

Mar 24, 2020

Revision history

2020-02-25 #1
ICSA-20-056-05 Honeywell WIN-PAK

References

ICS Advisory ICSA-20-056-05 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-056-05
Recommended Practices
https://www.us-cert.gov/ncas/tips/ST04-014
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B