PT-2019-5780 · Johnson Controls · Metasys

[e-mail] · Publicado 2019-08-20 · Atualizado 2020-02-10 · CVE-2019-7593

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Metasys versions prior to 9.0

Description The issue is related to the reuse of a cryptographic pair in encryption, which may allow a remote attacker to impact the confidentiality and integrity of protected information. The Metasys system uses a shared RSA key pair for certain encryption operations involving the Site Management Portal.

Recommendations For versions prior to 9.0, update to version 9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Site Management Portal to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-323

CWE-798

Identificadores relacionados

BDU:2021-02126

CVE-2019-7593

Produtos afetados

Metasys

Referências · 7

• https://us-cert.gov/ics/advisories/icsa-19-227-01 · Nota
• https://johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2019082103 · Nota
• https://osv.dev/vulnerability/CVE-2019-7593 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7593 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-02126 · Nota de Segurança
• https://securitylab.ru/vulnerability/500549.php · Nota