No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
Credit: Johnson Controls
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-0912 | CWE-532 Insertion of Sensitive Information into Log File | 7.7 High |
Under certain circumstances the Microsoft Internet Information Server (IIS) used to host the C●CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C●CURE 9000 or prior versions. Mitigation: Johnson Controls recommends the following: Vendor fix: Update Software House C●CURE 9000 to version 3.00.2 CU02 or 3.00.3 Mitigation: Change the password for the impacted windows accounts. Affected, fixed & timelineAffected:
Mitigation: Delete the api.log log file (or remove instances of passwords from the log file with a text editor) located at "C:\Program Files (x86)\Tyco\victorWebServices\victorWebsite\Logs" Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2024-04 v1 Mitigation: Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-0912 | 8.5 High | Johnson Controls Software House C•CURE 9000 Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows crede… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.