Vulnerability in Johnson Controls Exacqvision Enterprise Manager Versions 20.03.3.0 And Prior
CVE-2020-9047
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
EPSS: 0.078 (94.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- productsecurity@jci.com (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
- productsecurity@jci.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-9047?
- CVE-2020-9047 is a medium-severity vulnerability in Johnson Controls Exacqvision Enterprise Manager Versions 20.03.3.0 And Prior, classified under Improper Verification of Cryptographic Signature. CVSS score: 6.8/10. Published 2020-06-26.
- How severe is CVE-2020-9047?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2020-9047 known to be exploited?
- 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.