Multiple vulnerabilities in Johnson Controls Illustra Essentials Gen 4

Published: 2024-06-28

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2024-32932 CVE-2024-32755 CVE-2024-32756 CVE-2024-32757
CWE-ID	CWE-257 CWE-20 CWE-532
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Illustra Essential Gen 4 Other software / Other software solutions
Vendor	Johnson Controls

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Storing passwords in a recoverable format

EUVDB-ID: #VU93489

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32932

CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to storing passwords in a recoverable format. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3

External links

http://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU93493

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote administrator can pass specially crafted input to the application and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3

External links

http://www.cisa.gov/news-events/ics-advisories/icsa-24-179-04

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Storing passwords in a recoverable format

EUVDB-ID: #VU93492

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32756

CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to storing passwords in a recoverable format. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3

External links

http://www.cisa.gov/news-events/ics-advisories/icsa-24-179-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU93490

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32757

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A remote administrator can read the log files and gain access to sensitive data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3

External links

http://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.