CVE-2012-2607

2012-07-1620:49:19

CWE-78

[email protected]

web.nvd.nist.gov

johnson controls

ck721-a

firmware

vulnerability

remote attackers

tcp port 41014

cve-2012-2607

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.2%

JSON

The Johnson Controls CK721-A controller with firmware before SSM4388_03.1.0.14_BB allows remote attackers to perform arbitrary actions via crafted packets to TCP port 41014 (aka the download port).

Affected configurations

NVD

Node

johnsoncontrolsnetwork_controllerMatchck721-a

AND

johnsoncontrolsnetwork_controller_firmwareRange≤03.1.0.14

johnsoncontrolsnetwork_controller_firmwareMatch03.0

CPENameOperatorVersion
johnsoncontrols:network_controllerjohnsoncontrols network controllereqck721-a
johnsoncontrols:network_controller_firmwarejohnsoncontrols network controller firmwarele03.1.0.14
johnsoncontrols:network_controller_firmwarejohnsoncontrols network controller firmwareeq03.0

CPE	Name	Operator	Version
johnsoncontrols:network_controller	johnsoncontrols network controller	eq	ck721-a
johnsoncontrols:network_controller_firmware	johnsoncontrols network controller firmware	le	03.1.0.14
johnsoncontrols:network_controller_firmware	johnsoncontrols network controller firmware	eq	03.0