High ICSA-20-147-02 1 CVE

Johnson Controls Kantech EntraPass

Published May 26, 2020 · Updated May 26, 2020

Vendor: Kantech, Johnson Controls Product: Corporate Edition Product: Global Edition Product: Special Edition

Vulnerabilities 1

High 8.8

CVE-2020-9046

Kantech EntraPass Security Management Software - System Permissions Vulnerability

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.

Johnson Controls Kantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior Kantech EntraPass Security Management Software Global Edition versions 8.22 and prior

May 26, 2020

Revision history

2020-05-26 #1
ICSA-20-147-02 Johnson Controls Kantech EntraPass

References

ICS Advisory ICSA-20-147-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-147-02
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-20-147-02
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B