CVE-2020-9045

C•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software.

State: Published
Severity: 9.9 Critical
Published: May 21, 2020
Updated: Aug 4, 2024
Reserved: Feb 18, 2020

Read the record on cve.org

Description

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	jci

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
Software House C•CURE 9000 v2.70Johnson Controls	2.70Affected
American Dynamics victor Video Management System v5.2Johnson Controls	5.2Affected

References

https://www.johnsoncontrols.com/cyber-solutions/security-advisories
ICS-CERT Advisorythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.