ICSA-19-227-01

Johnson Controls Metasys

Advisory ansehen veröffentlicht 2019-08-15

Successful exploitation of these vulnerabilities could be leveraged by an attacker to decrypt captured network traffic.

beschreibt (2)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2019-7594US	critical9.1OT erhöht	0.63% (50th)	—	2019-08-20
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-7593US	critical9.1OT erhöht	0.82% (57th)	—	2019-08-20
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

ICS Advisory ICSA-19-227-01 JSONself
ICS Advisory ICSA-19-227-01 Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

Behebungen (2)

MitigationMetasys system
Users should upgrade to Version 9.0 or later and configure sites with trusted certificates.
MitigationMetasys system
Users should upgrade to Version 9.0 or later and configure sites with trusted certificates.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan