Vulnerability · Published Jul 4, 2024 · Assigned by jci
CVE-2024-32754Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information
Low 3.1
In plain English
A low-severity information exposure in Kantech KT1 Door Controller, Rev01 from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.2%top 87.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | Kantech KT1 Door Controller, Rev01 | 0 – through 2.09.10 |
| Johnson Controls | Kantech KT2 Door Controller, Rev01 | 0 – through 2.09.10 |
| Johnson Controls | Kantech KT400 Door Controller, Rev01 | 0 – through 3.01.16 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N