PT-2020-11247 · Kantech · Kantech Entrapass Global Edition+1

Joachim Kerschbaumer · Published 2020-03-10 · Updated 2020-03-11 · CVE-2019-7589

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kantech EntraPass Corporate Edition versions 8.0 and prior Kantech EntraPass Global Edition versions 8.0 and prior

Description A vulnerability exists in the SmartService API Service option, allowing an unauthorized user to potentially upload malicious code to the server, which could be executed at system level privileges.

Recommendations For Kantech EntraPass Corporate Edition versions 8.0 and prior, update to a version later than 8.0 to resolve the issue. For Kantech EntraPass Global Edition versions 8.0 and prior, update to a version later than 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the SmartService API Service option until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-7589

Affected Products

Kantech Entrapass Corporate Edition

Kantech Entrapass Global Edition

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-7589 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7589 · Vendor Advisory
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-070-04 · Note