PT-2019-18662 · Johnson Controls · Metasys

[e-mail] · Publicado 2019-08-20 · Atualizado 2020-02-10 · CVE-2019-7594

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Metasys versions prior to 9.0

Description The issue concerns the use of a hardcoded RC2 key for encryption operations involving the Site Management Portal.

Recommendations For versions prior to 9.0, update to version 9.0 or later to resolve the issue.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-321

Identificadores relacionados

CVE-2019-7594

Produtos afetados

Metasys

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-7594 · Aviso do Fabricante
• https://us-cert.gov/ics/advisories/icsa-19-227-01 · Nota
• https://johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7594 · Nota de Segurança