CVE-2019-7589

CRITICO 9.8CVE-2019-7589 · Published 10/03/2020 · updated 17/06/2026

In breve

CVE-2019-7589 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda entrapass (johnsoncontrols).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.8% delle vulnerabilità.
Correzione: aggiornare a 8.10 o successiva.

Package	Affected versions	Patched versions
entrapass johnsoncontrols	`< 8.10`	`8.10`

Description

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.

References

johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
us-cert.gov/ics/advisories/icsa-20-070-04 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free