CVE-2019-7589

Kantech EntraPass Improper Input Validation

State: Published
Severity: 9.8 Critical
Published: Mar 10, 2020
Updated: Aug 4, 2024
Reserved: Feb 7, 2019

Description

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	jci

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Kantech EntraPass Corporate EditionJohnson Controls	versions 8.0 and priorAffected
Kantech EntraPass Global EditionJohnson Controls	versions 8.0 and priorAffected

References

https://www.johnsoncontrols.com/cyber-solutions/security-advisories
ICS-CERT Advisorythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.