Active Debug Code in Johnson Controls products - CVE-2023-4804

Vulnerability identifier: #VU82962

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2023-4804

CWE-ID: CWE-489

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Johnson Controls

Affected software:
Quantum HD Unity Compressor control panels (Q5)
Quantum HD Unity Compressor control panels (Q6)
Quantum HD Unity AcuAir control panels(Q5)
Quantum HD Unity AcuAir control panels(Q6)
Quantum HD Unity Condenser/Vessel control panels (Q5)
Quantum HD Unity Condenser/Vessel control panels (Q6)
Quantum HD Unity Evaporator control panels (Q5)
Quantum HD Unity Evaporator control panels (Q6)
Quantum HD Unity Engine Room control panels (Q5)
Quantum HD Unity Engine Room control panels (Q6)
Quantum HD Unity Interface control panels (Q5)
Quantum HD Unity Interface control panels (Q6)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the active debug code issue. A remote attacker can access debug features that were accidentally exposed.

Install updates from vendor's website.

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01
• https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2023/jci-psa-2023-09.pdf?la=en&hash=3A4A98244141122D9019B5EAF3B58314DAA63E4D