Lucene search

JciCVE-2023-0954

HistoryJun 08, 2023 - 9:15 p.m.

CVE-2023-0954

2023-06-0821:15:16

CWE-489

jci

web.nvd.nist.gov

cve-2023-0954

sensormatic

electronics

illustra pro

gen 4

dome cameras

ptz cameras

credentials

compromise

sustained attack

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.

Affected configurations

Nvd

Node

johnsoncontrolsillustra_pro_gen_4_dome_firmwareRange≤ss016.05.09.04.0006

AND

johnsoncontrolsillustra_pro_gen_4_domeMatch-

Node

johnsoncontrolsillustra_pro_gen_4_ptz_firmwareRange≤ss010.05.09.04.0022

AND

johnsoncontrolsillustra_pro_gen_4_ptzMatch-

VendorProductVersionCPE
johnsoncontrolsillustra_pro_gen_4_dome_firmware*cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_dome_firmware:*:*:*:*:*:*:*:*
johnsoncontrolsillustra_pro_gen_4_dome-cpe:2.3:h:johnsoncontrols:illustra_pro_gen_4_dome:-:*:*:*:*:*:*:*
johnsoncontrolsillustra_pro_gen_4_ptz_firmware*cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_ptz_firmware:*:*:*:*:*:*:*:*
johnsoncontrolsillustra_pro_gen_4_ptz-cpe:2.3:h:johnsoncontrols:illustra_pro_gen_4_ptz:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
johnsoncontrols	illustra_pro_gen_4_dome_firmware	*	cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_dome_firmware::::::::
johnsoncontrols	illustra_pro_gen_4_dome	-	cpe:2.3:h:johnsoncontrols:illustra_pro_gen_4_dome:-:::::::*
johnsoncontrols	illustra_pro_gen_4_ptz_firmware	*	cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_ptz_firmware::::::::
johnsoncontrols	illustra_pro_gen_4_ptz	-	cpe:2.3:h:johnsoncontrols:illustra_pro_gen_4_ptz:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Illustra Pro Gen 4 Dome",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThanOrEqual": "Illustra.SS016.05.09.04.0006",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Illustra Pro Gen 4 PTZ",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThanOrEqual": "Illustra.SS010.05.09.04.0022",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-159-02

www.johnsoncontrols.com/cyber-solutions/security-advisories

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

Related for CVE-2023-0954