Johnson Controls Kantech Gen1 ioSmart

Summary

Vulnerabilities 1

• High 7.5
  CVE-2023-0248

  Kantech Gen1 ioSmart card reader

  An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

  Sensormatic Electronics, a subsidiary of Johnson Controls ioSmart Gen1
  Dec 14, 2023

Revision history

1. 2023-12-14 #1

   Initial Publication

References

• ICSA Advisory ICSA-23-348-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B