CVE-2020-9045 Information disclosure in American Dynamics victor Video Management System v5.2
Attackers can read cleartext user credentials from persistent installation logs, potentially leading to account takeover in C•CURE 9000 and victor VMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9045?
CVE-2020-9045 is a critical vulnerability in Johnson Controls American Dynamics victor Video Management System v5.2, published on 21 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.
Weakness: CWE-312
Which versions are affected by CVE-2020-9045?
It affects 2 products.
Products include Johnsoncontrols C-Cure 9000 Firmware, Tyco Victor Video Management System.
How do I fix CVE-2020-9045?
No fix has been published for CVE-2020-9045 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9045 being exploited?
There is no known exploitation of CVE-2020-9045 in the wild and no public exploit code.
Other vulnerabilities in Johnson Controls American Dynamics victor Video Management System v5.2
Sources
Also known as GHSA-389j-cw3h-6fc8.