Johnson Controls exacqVision Server web service
view advisory published 2024-08-01
Successful exploitation of this vulnerability could allow an attacker to send an unauthorized request or access data from an untrusted domain.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-32862US | high8.1 | — | ||
Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-214-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-214-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationexacqVision Web Service
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
- FixedexacqVision Web Service
Johnson Controls recommends that users update exacqVision Web Service to version 24.06.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan