Multiple vulnerabilities in Johnson Controls Illustra Essentials Gen 4



Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2024-32932
CVE-2024-32755
CVE-2024-32756
CVE-2024-32757
CWE-ID CWE-257
CWE-20
CWE-532
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Illustra Essential Gen 4
Other software / Other software solutions

Vendor Johnson Controls

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Storing passwords in a recoverable format

EUVDB-ID: #VU93489

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32932

CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to storing passwords in a recoverable format. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU93493

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote administrator can pass specially crafted input to the application and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-04


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Storing passwords in a recoverable format

EUVDB-ID: #VU93492

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32756

CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to storing passwords in a recoverable format. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-05


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU93490

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32757

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A remote administrator can read the log files and gain access to sensitive data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Illustra Essential Gen 4: 4.01.02.10.5982

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###