Multiple vulnerabilities in Johnson Controls Metasys



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2019-7593
CVE-2019-7594
CWE-ID CWE-323
CWE-321
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Metasys System
Universal components / Libraries / Software for developers

Vendor Johnson Controls

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Reusing a Nonce, Key Pair in Encryption

EUVDB-ID: #VU20344

Risk: Medium

CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-7593

CWE-ID: CWE-323 - Reusing a Nonce, Key Pair in Encryption

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt captured network traffic.

The vulnerability exists due to the ADS/ADX servers and NAE/NIE/NCE engines make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). A remote attacker with access to the shared RSA key pair can decrypt captured network traffic between the Metasys ADS/ADX servers or NAE/NIE/NCE engines and the connecting SMP user client.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Metasys System: before 9.0

CPE2.3 External links

https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of Hard-coded Cryptographic Key

EUVDB-ID: #VU20345

Risk: Medium

CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-7594

CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt captured network traffic.

The vulnerability exists due to the ADS/ADX servers and NAE/NIE/NCE engines make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP). A remote attacker with access to the hardcoded RC2 key can decrypt captured network traffic between the Metasys ADS/ADX servers or NAE/NIE/NCE engines and the connecting SMP user client.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Metasys System: before 9.0

CPE2.3 External links

https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###