Cross-Site Request Forgery in Honeywell WIN-PAK 4.7.2 and Earlier
CVE-2020-7005

8.8HIGH

Key Information:

Vendor

Honeywell

Status
Honeywell Win-pak 4.7.2, Web And Prior Versions
Vendor
CVE Published:
24 March 2020

What is CVE-2020-7005?

Honeywell WIN-PAK 4.7.2 and earlier versions are susceptible to a cross-site request forgery vulnerability. This flaw could allow an attacker to trick users into executing unintended commands, potentially leading to the execution of arbitrary code from a remote location. Organizations utilizing this product are advised to implement urgent security measures to mitigate potential threats.

Affected Version(s)

Honeywell WIN-PAK 4.7.2, Web and prior Honeywell WIN-PAK 4.7.2, Web and prior versions

References

https://www.us-cert.gov/ics/advisories/icsa-20-056-05
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.