Exacq exacqVision Server Unquoted Service Path Vulnerability (CVE-2019-7590)

Critical Vulnerability Information Vulnerability Overview - CVSS v3 Score: 6.7 - Vendor: Exacq Technologies, Inc., a subsidiary of Johnson Controls - Product: exacqVision Server - Vulnerability: Unquoted Search Path or Element Risk Assessment - Successful exploitation of this vulnerability allows unauthorized users to escalate privileges. Technical Details - Affected Products: exacqVision Server versions 9.6 and 9.8 - Vulnerability Summary: Certain services contain unquoted service paths, allowing authenticated users to insert code into the system root path, which is executed when the application starts. Background - Critical Infrastructure Sector: Critical Manufacturing - Deployment Region: Global - Company Headquarters: Ireland Researchers - Gjoko Kristic of Zero Science Lab reported this vulnerability to Johnson Controls. Mitigation - Upgrade to the latest version 19.03 - Visit the Johnson Controls Product Security Website for ICS security advisories and product security guidance. - Avoid clicking on unknown links or opening attachments in emails. - Refer to Identifying and Avoiding Email Scams to prevent social engineering attacks. - Additional measures and reports are available via the ICS Website and related links. Vendor - Johnson Controls Critical Vulnerability ID - CVE-2019-7590 Classification ID - CWE-428

Goal Reached Thanks to every supporter — we hit 100%!

Exacq exacqVision Server Unquoted Service Path Vulnerability (CVE-2019-7590)