Kantech EntraPass Improper Input Validation
CVE-2019-7589

9.8CRITICAL

Key Information:

Vendor

Johnson Controls

Status
Kantech Entrapass Corporate Edition
Kantech Entrapass Global Edition
Vendor
CVE Published:
10 March 2020

What is CVE-2019-7589?

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.

Affected Version(s)

Kantech EntraPass Corporate Edition versions 8.0 and prior

Kantech EntraPass Global Edition versions 8.0 and prior

References

https://www.johnsoncontrols.com/cyber-solutions/security-...
x_refsource_CONFIRM
https://www.us-cert.gov/ics/advisories/icsa-20-070-04
third-party-advisoryx_refsource_CERT

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joachim Kerschbaumer
.