CVE-2023-4804 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
jci	CNA	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Vendor	Product	Version
johnsoncontrols	quantum_hd_unity_compressor_firmware	11.00 ≤ 𝑥 < 11.22
johnsoncontrols	quantum_hd_unity_compressor_firmware	12.00 ≤ 𝑥 < 12.22
johnsoncontrols	quantum_hd_unity_acuair_firmware	11.00 ≤ 𝑥 < 11.12
johnsoncontrols	quantum_hd_unity_acuair_firmware	12.00 ≤ 𝑥 < 12.12
johnsoncontrols	quantum_hd_unity_condenser\/vessel_firmware	11.00 ≤ 𝑥 < 11.11
johnsoncontrols	quantum_hd_unity_condenser\/vessel_firmware	12.00 ≤ 𝑥 < 12.11
johnsoncontrols	quantum_hd_unity_evaporator_firmware	11.00 ≤ 𝑥 < 11.11
johnsoncontrols	quantum_hd_unity_evaporator_firmware	12.00 ≤ 𝑥 < 12.11
johnsoncontrols	quantum_hd_unity_engine_room_firmware	11.00 ≤ 𝑥 < 11.11
johnsoncontrols	quantum_hd_unity_engine_room_firmware	12.00 ≤ 𝑥 < 12.11
johnsoncontrols	quantum_hd_unity_interface_firmware	11.00 ≤ 𝑥 < 11.11
johnsoncontrols	quantum_hd_unity_interface_firmware	12.00 ≤ 𝑥 < 12.11

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-489 - Active Debug Code
The application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01

https://www.johnsoncontrols.com/cyber-solutions/security-advisories