Privilege escalation in Honeywell INNControl 3
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2020-6968 |
| CWE-ID | CWE-312 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
INNControl 3 Other software / Other software solutions |
| Vendor | Honeywell International, Inc |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Cleartext storage of sensitive information
EUVDB-ID: #VU25447
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:U/RL:U/RC:C]
CVE-ID: CVE-2020-6968
CWE-ID:
CWE-312 - Cleartext Storage of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the affected product allows workstation users to escalate application
user privileges through the modification of local configuration files. A local user can escalate user privileges within the INNControl application.
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsINNControl 3: 3.21
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-049-01
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
