Multiple vulnerabilities in Johnson Controls Metasys

Published: 2019-08-21

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-7593 CVE-2019-7594
CWE-ID	CWE-323 CWE-321
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Metasys System Universal components / Libraries / Software for developers
Vendor	Johnson Controls

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Reusing a Nonce, Key Pair in Encryption

EUVDB-ID: #VU20344

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-7593

CWE-ID: CWE-323 - Reusing a Nonce, Key Pair in Encryption

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt captured network traffic.

The vulnerability exists due to the ADS/ADX servers and NAE/NIE/NCE engines make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). A remote attacker with access to the shared RSA key pair can decrypt captured network traffic between the Metasys ADS/ADX servers or NAE/NIE/NCE engines and the connecting SMP user client.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Metasys System: before 9.0

External links

http://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of Hard-coded Cryptographic Key

EUVDB-ID: #VU20345