OpenCVE

Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Johnsoncontrols	Exacqvision Client Exacqvision Server

Configuration 1 [-]

OR	cpe:2.3:a:johnsoncontrols:exacqvision_client::::::::
	cpe:2.3:a:johnsoncontrols:exacqvision_server::::::::

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-01
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

History

Fri, 09 Aug 2024 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Tue, 06 Aug 2024 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Johnsoncontrols Johnsoncontrols exacqvision Client Johnsoncontrols exacqvision Server
CPEs		cpe:2.3:a:johnsoncontrols:exacqvision_client:::::::: cpe:2.3:a:johnsoncontrols:exacqvision_server::::::::
Vendors & Products		Johnsoncontrols Johnsoncontrols exacqvision Client Johnsoncontrols exacqvision Server
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2024-08-01T21:50:16.134Z

Updated: 2024-08-06T20:35:07.083Z

Reserved: 2024-04-17T17:26:35.181Z

Link: CVE-2024-32758

Vulnrichment

Updated: 2024-08-06T20:34:53.779Z

NVD

Status : Analyzed

Published: 2024-08-01T22:15:24.640

Modified: 2024-08-09T19:00:17.183

Link: CVE-2024-32758

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32758", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "state": "PUBLISHED", "assignerShortName": "jci", "dateReserved": "2024-04-17T17:26:35.181Z", "datePublished": "2024-08-01T21:50:16.134Z", "dateUpdated": "2024-08-06T20:35:07.083Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "exacqVision", "vendor": "Johnson Controls", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Reid Wightman of Dragos"}], "datePublic": "2024-08-01T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(9, 30, 66, 0.024);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<p>Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange</p>\n\n</span>\n\n </span>"}], "value": "Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange"}], "impacts": [{"capecId": "CAPEC-277", "descriptions": [{"lang": "en", "value": "CAPEC-277: Data Interchange Protocol Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-326", "description": "CWE-326: Inadequate Encryption Strength", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2024-08-01T21:50:16.134Z"}, "references": [{"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">Follow the guidance provided on the exacqVision Hardening Guide under the Password Strengthening section at </span><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.johnsoncontrols.com/trust-center/cybersecurity/resources.\">https://www.johnsoncontrols.com/trust-center/cybersecurity/resources.</a> \n\n</span>\n\n</span>\n\n</span>\n\n<br>"}], "value": "Follow the guidance provided on the exacqVision Hardening Guide under the Password Strengthening section at \n https://www.johnsoncontrols.com/trust-center/cybersecurity/resources."}], "source": {"discovery": "UNKNOWN"}, "title": "exacqVision - Key exchanges", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "johnsoncontrols", "product": "exacqvision_server", "cpes": ["cpe:2.3:a:johnsoncontrols:exacqvision_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "johnsoncontrols", "product": "exacqvision_client", "cpes": ["cpe:2.3:a:johnsoncontrols:exacqvision_client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-06T20:29:29.999907Z", "id": "CVE-2024-32758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T20:35:07.083Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-06T20:29:29.999907Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:johnsoncontrols:exacqvision_server:*:*:*:*:*:*:*:*"], "vendor": "johnsoncontrols", "product": "exacqvision_server", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:johnsoncontrols:exacqvision_client:*:*:*:*:*:*:*:*"], "vendor": "johnsoncontrols", "product": "exacqvision_client", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T20:34:53.779Z"}}], "cna": {"title": "exacqVision - Key exchanges", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Reid Wightman of Dragos"}], "impacts": [{"capecId": "CAPEC-277", "descriptions": [{"lang": "en", "value": "CAPEC-277: Data Interchange Protocol Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Johnson Controls", "product": "exacqVision", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Follow the guidance provided on the exacqVision Hardening Guide under the Password Strengthening section at \n https://www.johnsoncontrols.com/trust-center/cybersecurity/resources.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">Follow the guidance provided on the exacqVision Hardening Guide under the Password Strengthening section at </span><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.johnsoncontrols.com/trust-center/cybersecurity/resources.\">https://www.johnsoncontrols.com/trust-center/cybersecurity/resources.</a> \n\n</span>\n\n</span>\n\n</span>\n\n<br>", "base64": false}]}], "datePublic": "2024-08-01T16:00:00.000Z", "references": [{"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-01"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(9, 30, 66, 0.024);\">\n\n<span style=\"background-color: rgba(9, 30, 66, 0.06);\">\n\n<p>Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange</p>\n\n</span>\n\n </span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326: Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2024-08-01T21:50:16.134Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32758", "state": "PUBLISHED", "dateUpdated": "2024-08-06T20:35:07.083Z", "dateReserved": "2024-04-17T17:26:35.181Z", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "datePublished": "2024-08-01T21:50:16.134Z", "assignerShortName": "jci"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:exacqvision_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "85B503B0-E99F-4043-B7A0-6CAA892D5066", "versionEndExcluding": "24.06", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:exacqvision_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C400916-0D66-45D5-83B2-E5F2C71C50B2", "versionEndExcluding": "24.06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange"}, {"lang": "es", "value": " En determinadas circunstancias, la comunicaci\u00f3n entre el Cliente exacqVision y el Servidor exacqVision utilizar\u00e1 una longitud de clave e intercambio insuficientes."}], "id": "CVE-2024-32758", "lastModified": "2024-08-09T19:00:17.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "subsequentSystemIntegrity": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "productsecurity@jci.com", "type": "Secondary"}]}, "published": "2024-08-01T22:15:24.640", "references": [{"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-01"}, {"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-326"}], "source": "productsecurity@jci.com", "type": "Secondary"}]}