Vulnerability in Johnson Controls Exacqvision Enterprise Manager Versions 20.03.3.0 And Prior
CVE-2020-9047
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.078 (94.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.078 · newest: 0.078 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.us-cert.gov/ics/advisories/ICSA-20-170-01 (US Government Resource, Third Party Advisory, third-party-advisory)
- www.johnsoncontrols.com/cyber-solutions/security-advisories (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-9047?
- CVE-2020-9047 is a medium-severity vulnerability in Johnson Controls Exacqvision Enterprise Manager Versions 20.03.3.0 And Prior, classified under Improper Verification of Cryptographic Signature. CVSS score: 6.8/10. Published 2020-06-26.
- How severe is CVE-2020-9047?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2020-9047 known to be exploited?
- 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.