Active Debug Code in Johnson Controls products - CVE-2023-4804

Vulnerability identifier: #VU82962

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4804

CWE-ID: CWE-489

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the active debug code issue. A remote attacker can access debug features that were accidentally exposed.

Quantum HD Unity Condenser/Vessel control panels (Q5)
Quantum HD Unity Evaporator control panels (Q5)
Quantum HD Unity Engine Room control panels (Q5)
Quantum HD Unity Interface control panels (Q5)
Quantum HD Unity AcuAir control panels(Q5)
Quantum HD Unity Compressor control panels (Q5)
Quantum HD Unity Condenser/Vessel control panels (Q6)
Quantum HD Unity Evaporator control panels (Q6)
Quantum HD Unity Engine Room control panels (Q6)
Quantum HD Unity Interface control panels (Q6)
Quantum HD Unity AcuAir control panels(Q6)
Quantum HD Unity Compressor control panels (Q6)

Install updates from vendor's website.

Quantum HD Unity Condenser/Vessel control panels (Q5) - update to 11.11
Quantum HD Unity Evaporator control panels (Q5) - update to 11.11
Quantum HD Unity Engine Room control panels (Q5) - update to 11.11
Quantum HD Unity Interface control panels (Q5) - update to 11.11
Quantum HD Unity AcuAir control panels(Q5) - update to 11.12
Quantum HD Unity Compressor control panels (Q5) - update to 11.22
Quantum HD Unity Condenser/Vessel control panels (Q6) - update to 12.11
Quantum HD Unity Evaporator control panels (Q6) - update to 12.11
Quantum HD Unity Engine Room control panels (Q6) - update to 12.11
Quantum HD Unity Interface control panels (Q6) - update to 12.11
Quantum HD Unity AcuAir control panels(Q6) - update to 12.12
Quantum HD Unity Compressor control panels (Q6) - update to 12.22

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01
• https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2023/jci-psa-2023-09.pdf?la=en&hash=3A4A98244141122D9019B5EAF3B58314DAA63E4D

• Active Debug Code in Johnson Controls Quantum HD Unity