Medium severity · published Aug 1, 2018
CVE-2018-10624
Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
BCPro (BCM) · Johnson Controls
before 3.0.2 · source: vendor
MS
Metasys System · Johnson Controls
through 8.0 · source: vendor, NVD
BC
Bcpro · Johnsoncontrols
before 3.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10624
Third Party Advisory
http://www.securityfocus.com/bid/104937
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-18-212-02
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02