Johnson Controls exacqVision client and exacqVision server
view advisory published 2024-08-01
Successful exploitation of this vulnerability could allow an attacker to be able to decrypt communications between exacqVision Server and exacqVision Client due to insufficient key length and exchange.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-32758US | high7.5 | — | ||
Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-214-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-214-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationexacqVision Client
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
- MitigationexacqVision Server
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan