10 CISA ICS advisories for Johnson Controls in the last tracking window, 0 flagged as relevant to oil & gas. Newest first.
CISA reports 2 vulnerabilities in Johnson Controls EasyIO FG firmware. Weakness types: Use of Hard-coded Credentials, Improper Privilege Management. Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. Highest CVSS v3 score: 7.7 (High), not remotely ex…
CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Cleartext Transmission of Sensitive Information. Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials and…
CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used…
CISA reports 1 vulnerability in Johnson Controls Simplex Incident Manager. Weakness type: Cleartext Storage of Sensitive Information in Memory. Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system mem…
CISA reports 1 vulnerability in Johnson Controls Metasys 12, Metasys 13, Metasys 14, Metasys 15. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent maliciou…
CISA reports 2 vulnerabilities in Johnson Controls Airwall. Weakness types: Use of Hard-coded Cryptographic Key, External Control of File Name or Path. Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read …
CISA reports 1 vulnerability in Johnson Controls TL280. Weakness type: Use of a Broken or Risky Cryptographic Algorithm. Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. Highest CVSS v3 score: 4.1 (Medium), exploitable over the network.
CISA reports 3 vulnerabilities in Johnson Controls OpenBlue Employee (FMS Employee). Weakness types: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Succe…
CISA reports 1 vulnerability in Johnson Controls XAAP Android. Weakness type: Cleartext Storage of Sensitive Information. Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. Highest CVSS v3 score: 3.3 (Low), not remotely exploitable per its CVSS …
CISA reports 3 vulnerabilities in Johnson Controls C-CURE 9000, victor Application Server, victor, victor Web. Weakness types: Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges. Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code ex…
Every week: the new ICS advisories that touch oil & gas gear, what they mean, and what to do. Free.
TODO: signup form not connected to a provider yet