Medium severity · published May 21, 2020
CVE-2020-9045
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the…
6.5
CVSS
1%
EPSS
No
On KEV
Description
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C9
C-cure 9000 Firmware · Johnsoncontrols
2.70 · source: NVD
VV
Victor Video Management System · Tyco
5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9045
Patch
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Third Party Advisory
https://www.us-cert.gov/ics/advisories/ICSA-20-142-01
More from C-cure 9000 Firmware
8.8
CVE-2021-27660
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs
5.3
CVE-2021-36201
CCURE Observable Response Discrepancy