CVE-2012-2607: Johnson Controls CK721-A/P2000 RCE Vulnerability

Vulnerability Key Information Vulnerability ID: VU#977312 CVE Identifier: CVE-2012-2607 Original Release Date: 2012-07-13 Last Revised Date: 2013-04-03 Vulnerability Overview Johnson Controls CK721-A and P2000 products are affected by a remote command execution vulnerability, which may allow unauthorized remote attackers to perform various operations on the devices. Description The CK721-A device has a vulnerability on its "download" port (TCP/41014), allowing unauthorized attackers to send specially crafted packets to execute remote commands, such as unlocking doors, adding/removing access cards, or modifying configurations. The P2000 (Pegasys) server is vulnerable to false alarm injection via its "upload" port (TCP/41013), which only validates source IP addresses. Attackers can send falsified data to this port. Impact Attackers can remotely execute various tasks, including unlocking doors, adding/removing access cards, and modifying configurations, potentially leading to unauthorized physical access to secured areas. The P2000 device can be exploited to log false alarms, making it difficult to detect genuine alarms. Solution Update: - Deploy strong encryption (e.g., AES) to secure all IP communications between CK-721 and the P2000 security server. - Update the P2000 security application software, CK-721 controller modules, and controller firmware. - Enable encryption features; refer to standard documentation for details. Restrict Access: - Configure appropriate firewall rules to block traffic from untrusted sources to TCP ports 41013 and 41014. CVSS Metrics Acknowledgments: Vulnerability reported by Travis Lee; document authored by Michael Orlando.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2012-2607: Johnson Controls CK721-A/P2000 RCE Vulnerability