Low severity · published Jul 4, 2024
CVE-2024-32754
Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KK
Kantech KT1 Door Controller, Rev01 · Johnson Controls
through 2.09.10 · source: vendor
KK
Kantech KT2 Door Controller, Rev01 · Johnson Controls
through 2.09.10 · source: vendor
KK
Kantech KT400 Door Controller, Rev01 · Johnson Controls
through 3.01.16 · source: vendor
Affected product
KK
Kantech KT1 Door Controller, Rev01
Johnson Controls