Johnson Controls Inc. Software House C●CURE 9000 (Update B)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION : Exploitable remotely/Low attack complexity Vendor : Johnson Controls Inc. Equipment : Software House C●CURE 9000 Vulnerability : Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an...

Johnson Controls Illustra Pro Gen 4

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION : Exploitable remotely Vendor : Johnson Controls, Inc. Equipment : Illustra Pro Gen 4 Vulnerability : Dependency on Vulnerable Third-Party Component 2. RISK EVALUATION Successful exploitation of this vulnerability could impact confidentiality...

CVE-2024-32754 Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information...

CVE-2024-32754 Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information...

PT-2024-24827 · Johnson Controls · Kt1 +2

Name of the Vulnerable Software and Affected Versions: KT1, KT2, and KT400 controllers affected versions not specified Description: The issue concerns the broadcasting of sensitive information when the controller is in factory reset mode. Specifically, the controller broadcasts its MAC address,...

Johnson Controls Kantech Door Controllers

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 3.1 ATTENTION : Exploitable via adjacent network Vendor : Johnson Controls, Inc. Equipment : Kantech KT1, KT2, KT400 Door Controllers Vulnerability : Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of...

PT-2024-24828 · Johnson Controls · American Dynamics Illustra Essentials Gen 4 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The web interface may accept characters unrelated to the expected input under certain circumstances. Recommendations: At the moment, there is no information about a newer version that...

Johnson Controls Illustra Essentials Gen 4 Security Vulnerability

Johnson Controls Illustra Essentials Gen 4 is a bullet camera from Johnson Controls USA. A security vulnerability exists in Johnson Controls Illustra Essentials Gen 4 Illustra.Ess4.01.02.10.5982 and prior versions, which stems from the fact that Linux user credentials can be recovered by an...

PT-2024-24987 · Johnson Controls · American Dynamics Illustra Essentials Gen 4 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, use: affected versions not specified Description: The issue allows an authenticated user to recover another user's credentials under certain circumstances. Recommendations: At the moment, there is n...

Johnson Controls Illustra Essentials Gen 4 Security Vulnerability

Johnson Controls Illustra Essentials Gen 4 is a bullet camera from Johnson Controls USA. A security vulnerability exists in Johnson Controls Illustra Essentials Gen 4 Illustra.Ess4.01.02.10.5982 and prior versions, which originates from the possibility that an authenticated user could recover web...

Johnson Controls Illustra Essentials Gen 4 Security Vulnerability

Johnson Controls Illustra Essentials Gen 4 is a bullet camera from Johnson Controls USA. A security vulnerability exists in Johnson Controls Illustra Essentials Gen 4 Illustra.Ess4.01.02.10.5982 and prior versions, which stems from unnecessary user details being provided in the system log...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability may...

CVE-2024-32752 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access...

Johnson Controls Software House iStar Door Controller (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS 4 8.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls Inc. Equipment : Software House iStar Pro Door Controller, ICU Vulnerability : Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this...

PT-2024-5077 · Johnson Controls · Istar Pro Door Controller

Name of the Vulnerable Software and Affected Versions: Johnson Controls Software House iStar Pro Door Controller affected versions not specified Description: The issue is related to the lack of authentication for a critical function in the ICU tool and iSTAR Pro door controller, which can be...

Johnson Controls Software House iStar Pro Door Controller Security Vulnerability

Johnson Controls Software House iStar Pro Door Controller is an access control device from Johnson Controls, Inc. A security vulnerability exists in the Johnson Controls Software House iStar Pro Door Controller that stems from vulnerability to man-in-the-middle attacks that could affect door...

Johnson Controls Software House C-CURE 9000 Log Message Disclosure Vulnerability

Johnson Controls Software House C-CURE 9000 is a scalable multi-site access control and alarm monitoring system from Johnson Controls, Inc. A log information disclosure vulnerability exists in Johnson Controls Software House C-CURE 9000 version 3.00.2, which originates from recording detailed...

Johnson Controls Software House C●CURE 9000

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION : Low attack complexity Vendor : Johnson Controls Equipment : Software House C●CURE 9000 Vulnerability : Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to...

This Week in Spring - May 14th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week's highlights in the Spring ecosystem emphasize the ongoing advancements and applications of Spring AI. The discussions range from exploring the impressive VectorStore abstraction and enhanced structured output suppo...