For awareness Low Check exposure in your normal cycle
Johnson Controls access control software has two confirmed flaws
Canadian Centre for Cyber SecurityJohnson Controls, Kantech · building automation
What happened. Johnson Controls has confirmed two vulnerabilities in Kantech Entrapass versions before 9.20. The Canadian Cyber Centre urges users to review the vendor advisories and apply updates as they become available.
Who is affected. Users of Johnson Controls Kantech Entrapass before 9.20, an access control system used in building automation.
What to do. Check whether you run Kantech Entrapass before 9.20, then read the Johnson Controls advisory and apply the update.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerIT security
- Purdue level
- L3
- L2
Why: Entrapass is access control management software that runs on a site server or workstation, which sits at the supervisory and site operations levels.
- Are you exposed?
Check your asset inventory and installed software for Kantech Entrapass and confirm the version is 9.20 or later.
- If you cannot fix it yet
- Restrict network access to the Entrapass server to known administrator hosts only.
- Keep the Entrapass server off the internet and behind a firewall.
- Watch for
- Logons to the Entrapass server from unexpected hosts or accounts.
- Unexpected changes to access control users, doors or schedules.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Canadian Centre for Cyber Security (opens cyber.gc.ca)
More on Johnson Controls Building automation