Riskcovery

CVE-2024-32754

Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

State
Published
Severity
3.1 Low
Published
Jul 4, 2024
Updated
Aug 27, 2025
Reserved
Apr 17, 2024

Read the record on cve.org

Description

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.

Scores

CVSSScoreVectorSource
3.13.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Njci

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Kantech KT1 Door Controller, Rev01Johnson Controls
  • 2.09.10 and earlierAffected
Kantech KT2 Door Controller, Rev01Johnson Controls
  • 2.09.10 and earlierAffected
Kantech KT400 Door Controller, Rev01Johnson Controls
  • 3.01.16 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.