CVE-2024-32754: Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

Published Jul 4, 2024

Updated

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.

Affected Software

3 affected components

Johnson Controls Kantech KT1 Door Controller

Johnson Controls Kantech KT2 Door Controller

Johnson Controls Kantech KT400 Door Controller

Remediation

Information

Update Kantech door controllers as follows: * Update Kantech KT1 Door Controller to at least version 3.10.12 * Update Kantech KT2 Door Controller to at least version 3.10.12 * Update Kantech KT400 Door Controller to at least version 3.03

Event History

Jul 4, 2024

CVE Published

via MITRE·10:43 AM

Data Sourced

via MITRE·10:43 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-32754?

CVE-2024-32754 is categorized as a medium severity vulnerability due to the potential exposure of sensitive information.

How do I fix CVE-2024-32754?

To mitigate CVE-2024-32754, ensure that the controllers are not left in factory reset mode for extended periods and configure them promptly.

What information is exposed in CVE-2024-32754?

CVE-2024-32754 exposes the MAC address, serial number, and firmware version of the controller during factory reset mode.

Which products are affected by CVE-2024-32754?

The affected products include the Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers.

Is the vulnerability CVE-2024-32754 persistent after configuration?

No, CVE-2024-32754 only broadcasts the sensitive information when the controller is in factory reset mode, and this stops once configured.