by Kastro
Paper/Archive/CVE-2024-32752

CVE-2024-32752

Johnson Controls iSTAR Configuration Utility (ICU) — Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 48.0.480 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access

Affected

ProductAffectedFixed inSource
iSTAR Configuration Utility (ICU)≤ All–CNA
iSTAR Pro, Edge and eX≤ All–CNA
iSTAR Ultra and Ultra LT< 6.6.B6.6.BCNA
software_house_istar_pro_door_controllerall–CISA-ADP
icuall–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
jci (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refjohnsoncontrols.com/trust-center/cybersecurity/security-advisoriesrefcisa.gov/news-events/ics-advisories/icsa-24-158-04refjohnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-06.pdf