CVE-2018-10624 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information
Attackers can obtain sensitive technical information via improper error handling in HTTP communications, affecting Johnson Controls Metasys and BCPro systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10624?
CVE-2018-10624 is a medium-severity vulnerability in Johnson Controls BCPro (BCM), published on 1 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
Which versions are affected by CVE-2018-10624?
It affects 2 products.
Products include Johnsoncontrols Bcpro, Johnsoncontrols Metasys System.
How do I fix CVE-2018-10624?
No fix has been published for CVE-2018-10624 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-10624 being exploited?
There is no known exploitation of CVE-2018-10624 in the wild and no public exploit code.
Sources
Also known as GHSA-6ph9-8g4v-9g63.