Improper input validation in Johnson Controls Kantech Entrapass Corporate Edition
CVE-2019-7589
A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (74.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Johnson Controls Kantech Entrapass Corporate Edition — versions versions 8.0 and prior
- Johnson Controls Kantech Entrapass Global Edition — versions versions 8.0 and prior
- Johnsoncontrols Entrapass
Weakness classification (CWE)
References
- www.johnsoncontrols.com/cyber-solutions/security-advisories (Vendor Advisory)
- www.us-cert.gov/ics/advisories/icsa-20-070-04 (US Government Resource, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2019-7589?
- CVE-2019-7589 is a critical-severity vulnerability in Johnson Controls Kantech Entrapass Corporate Edition, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2020-03-10.
- How severe is CVE-2019-7589?
- Critical severity. CVSS v3 base score is 9.8 out of 10.