Vulnerability · Published Nov 10, 2023 · Assigned by jci
CVE-2023-4804Quantum HD Unity
Critical 10.0
In plain English
A critical-severity security flaw in Quantum HD Unity AcuAir from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.8%top 43.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | Quantum HD Unity Compressor | 0 – before 11.220 – before 12.22 |
| Johnson Controls | Quantum HD Unity AcuAir | 0 – before 11.120 – before 12.12 |
| Johnson Controls | Quantum HD Unity Condenser/Vessel | 0 – before 11.110 – before 12.11 |
| Johnson Controls | Quantum HD Unity Evaporator | 0 – before 11.110 – before 12.11 |
| Johnson Controls | Quantum HD Unity Engine Room | 0 – before 11.110 – before 12.11 |
| Johnson Controls | Quantum HD Unity Interface | 0 – before 11.110 – before 12.11 |
Weakness: CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H