CVE-2020-9046 - Vulnerability Details - OpenCVE

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00041.

Key SSVC decision points have not yet been added.

Vendors	Products
Johnsoncontrols	Kantech Entrapass

Configuration 1 [-]

OR	cpe:2.3:a:johnsoncontrols:kantech_entrapass:::::corporate:::*
	cpe:2.3:a:johnsoncontrols:kantech_entrapass:::::global:::*
	cpe:2.3:a:johnsoncontrols:kantech_entrapass:::::special:::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2020-29875	A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.

Fixes

Solution

Upgrade all Kantech EntraPass Editions to version 8.23. Registered users can obtain the critical software update by downloading the zip file from the Software Downloads location at https://kantech.com/Support/SoftwareDownloads.aspx.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
https://www.us-cert.gov/ics/advisories/ICSA-20-147-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2020-05-26T20:05:08

Updated: 2024-08-04T10:19:19.774Z

Reserved: 2020-02-18T00:00:00

Link: CVE-2020-9046

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-05-26T21:15:11.173

Modified: 2024-11-21T05:39:53.617

Link: CVE-2020-9046

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior", "vendor": "Johnson Controls", "versions": [{"lessThanOrEqual": "8.22", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Kantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior", "vendor": "Johnson Controls", "versions": [{"lessThanOrEqual": "8.22", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Kantech EntraPass Security Management Software Global Edition versions 8.22 and prior", "vendor": "Johnson Controls", "versions": [{"lessThanOrEqual": "8.22", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 : Access Control (Authorization) Issues", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-05-26T20:05:08", "orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-147-02"}], "solutions": [{"lang": "en", "value": "Upgrade all Kantech EntraPass Editions to version 8.23.\n\nRegistered users can obtain the critical software update by downloading the zip file from the Software Downloads location at https://kantech.com/Support/SoftwareDownloads.aspx."}], "source": {"discovery": "EXTERNAL"}, "title": "Kantech EntraPass Security Management Software - System Permissions Vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productsecurity@jci.com", "ID": "CVE-2020-9046", "STATE": "PUBLIC", "TITLE": "Kantech EntraPass Security Management Software - System Permissions Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.22"}]}}, {"product_name": "Kantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.22"}]}}, {"product_name": "Kantech EntraPass Security Management Software Global Edition versions 8.22 and prior", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.22"}]}}]}, "vendor_name": "Johnson Controls"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 : Access Control (Authorization) Issues"}]}]}, "references": {"reference_data": [{"name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "refsource": "CONFIRM", "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "refsource": "CERT", "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-147-02"}]}, "solution": [{"lang": "en", "value": "Upgrade all Kantech EntraPass Editions to version 8.23.\n\nRegistered users can obtain the critical software update by downloading the zip file from the Software Downloads location at https://kantech.com/Support/SoftwareDownloads.aspx."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:19:19.774Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-147-02"}]}]}, "cveMetadata": {"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "assignerShortName": "jci", "cveId": "CVE-2020-9046", "datePublished": "2020-05-26T20:05:08", "dateReserved": "2020-02-18T00:00:00", "dateUpdated": "2024-08-04T10:19:19.774Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:kantech_entrapass:*:*:*:*:corporate:*:*:*", "matchCriteriaId": "E38999E4-FF79-4493-A4CA-AF2F0E775681", "versionEndIncluding": "8.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:kantech_entrapass:*:*:*:*:global:*:*:*", "matchCriteriaId": "35623689-6C6D-42F2-A735-5C714B6BB430", "versionEndIncluding": "8.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:kantech_entrapass:*:*:*:*:special:*:*:*", "matchCriteriaId": "67E9DF42-F84C-44C5-9E62-D5196E8DF694", "versionEndIncluding": "8.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files."}, {"lang": "es", "value": "Una vulnerabilidad en todas las versiones de Kantech EntraPass Editions podr\u00eda permitir potencialmente a un usuario autorizado poco privilegiado obtener privilegios de nivel system completos mediante el reemplazo de los archivos cr\u00edticos con archivos espec\u00edficamente dise\u00f1ados."}], "id": "CVE-2020-9046", "lastModified": "2024-11-21T05:39:53.617", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "productsecurity@jci.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-05-26T21:15:11.173", "references": [{"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-147-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-147-02"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "productsecurity@jci.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}