CVE-2020-9047
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 7.77% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Affected
- johnsoncontrols/exacqvision enterprise manager · johnsoncontrols/exacqvision web service
- Source
- productsecurity@jci.com
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesThird Party Advisory
- https://www.us-cert.gov/ics/advisories/ICSA-20-170-01Third Party Advisory, US Government Resource
- https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesThird Party Advisory
- https://www.us-cert.gov/ics/advisories/ICSA-20-170-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.