Technical impact
The vulnerability is a cleartext storage of sensitive information within an application’s memory, permitting an attacker who can read the running process’ memory to retrieve embedded sensitive data, which constitutes a confidentiality breach.
Affected Systems
Johnson Controls Kantech Entrapass versions earlier than 9.20 are affected.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. The exploitability requires the attacker to gain access to the application’s memory space, which may be achieved through local access or via exploitation of other flaws that provide memory read capabilities. While no exploitation probability data is available and the vulnerability is not listed in CISA KEV, the potential for sensitive data exposure remains significant if an attacker can obtain sufficient local privileges.
