Paper/Archive/CVE-2023-2024

CVE-2023-2024

Johnson Controls OpenBlue Enterprise Manager Data Collector — Improper Authentication for OpenBlue Enterprise Manager Data Collector

EPSS 1%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 65.3.653 × 2013.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.

Affected

ProductAffectedFixed inSource

OpenBlue Enterprise Manager Data Collector< 3.2.5.753.2.5.75CNA

Scores by source

jci (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjohnsoncontrols.com/cyber-solutions/security-advisories refcisa.gov/news-events/ics-advisories/icsa-23-138-04