Johnson Controls Vulnerabilities and Affected Products
Vulnerabilities associated with System Configuration Tool (SCT).
Products
Clear product- exacqVision6 vulnerabilities
- Frick Controls Quantum HD6 vulnerabilities
- Metasys ADS/ADX/OAS server6 vulnerabilities
- American Dynamics Illustra Essentials Gen 44 vulnerabilities
- iSTAR Configuration Utility (ICU)4 vulnerabilities
- Metasys4 vulnerabilities
- exacqVision Web Service3 vulnerabilities
- FM Systems Employee3 vulnerabilities
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG3 vulnerabilities
- iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G22 vulnerabilities
- iSTAR Ultra, iSTAR Ultra SE2 vulnerabilities
- Metasys versions prior to 9.02 vulnerabilities
- OpenBlue Enterprise Manager Data Collector2 vulnerabilities
- Software House C•CURE 90002 vulnerabilities
- System Configuration Tool (SCT)2 vulnerabilities
- American Dynamics victor Video Management System v5.21 vulnerability
- BCPro (BCM)1 vulnerability
- C-CURE 90001 vulnerability
- CCure 90001 vulnerability
- CCure 9000 and victor application server1 vulnerability
- CEM Systems AC20001 vulnerability
- CEVAS1 vulnerability
- C•CURE 90001 vulnerability
- C•CURE Web Client version 2.90 and prior (Note - This does not affect the new web-based C•CURE 9000 client that was introduced in C•CURE 9000 v2.90)1 vulnerability
- Entrapass1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-21940HIGH | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. | CVSS7.5v3.1 | EPSS0.372% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-21939HIGH | Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. | CVSS7.5v3.1 | EPSS0.546% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |