PT-2019-5780 · Johnson Controls · Metasys

[e-mail] · Published 2019-08-20 · Updated 2020-02-10 · CVE-2019-7593

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Metasys versions prior to 9.0

Description The issue is related to the reuse of a cryptographic pair in encryption, which may allow a remote attacker to impact the confidentiality and integrity of protected information. The Metasys system uses a shared RSA key pair for certain encryption operations involving the Site Management Portal.

Recommendations For versions prior to 9.0, update to version 9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Site Management Portal to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-323

CWE-798

Related Identifiers

BDU:2021-02126

CVE-2019-7593

Affected Products

Metasys

References · 7

• https://johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7593 · Security Note
• https://bdu.fstec.ru/vul/2021-02126 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-227-01 · Note
• https://cybersecurity-help.cz/vdb/SB2019082103 · Note
• https://securitylab.ru/vulnerability/500549.php · Note