CVE-2019-7594 - Metasys use of hardcoded RC2 key

Back Back to CVE browser

CRITICAL

Metasys use of hardcoded RC2 key

Published Aug 20, 2019

9.1

CRITICAL

CVSS 3.0

EPSS 0.63%

Description

Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).

Affected products

Remediation

Vendor solution

Upgrade Metasys® devices to Release 9.0 or later and configure sites with trusted certificates.

Weaknesses (2)

CWE-321

CWE-798

Hard-coded Credentials

References (2)

https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf
x_refsource_CONFIRMVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-227-01
x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf		x_refsource_CONFIRMVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-227-01		x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource