Johnson Controls Kantech Door Controllers

Summary

Vulnerabilities 1

• Low 3.1
  CVE-2024-32754

  Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

  Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.

  Johnson Controls Kantech KT2 Door Controller, Rev01 Kantech KT1 Door Controller, Rev01 Kantech KT400 Door Controller, Rev01
  Jul 4, 2024

Revision history

1. 2024-07-02 #1

   Initial Publication

References

• ICSA Advisory ICSA-24-184-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014