CVE-2020-9047 exacqVision Software - Improper Verification of Cryptographic Signature
An attacker with administrative privileges can execute unauthorized code or OS commands by bypassing cryptographic signature verification in exacqVision software.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-9047?
CVE-2020-9047 is a medium-severity code injection vulnerability in Johnson Controls exacqVision Enterprise Manager versions 20.03.3.0 and prior, published on 26 Jun 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
Weakness: CWE-347
Which versions are affected by CVE-2020-9047?
It affects 2 products.
Products include Johnsoncontrols Exacqvision Enterprise Manager, Johnsoncontrols Exacqvision Web Service.
How do I fix CVE-2020-9047?
No fix has been published for CVE-2020-9047 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-9047 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-9047 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Johnson Controls exacqVision Enterprise Manager versions 20.03.3.0 and prior
Sources
Also known as GHSA-jhjw-25g5-p452.