CVE-2024-0242 (GCVE-0-2024-0242)
Vulnerability from cvelistv5
Published
2024-02-08 19:34
Modified
2024-08-01 17:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Qolsys, Inc. | IQ Panel 4 |
Version: 0 < 4.4.2 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-09T16:33:51.654700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:47.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T17:41:16.073Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ Panel 4",
"vendor": "Qolsys, Inc.",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ4 Hub",
"vendor": "Qolsys, Inc.",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Cody Jung"
}
],
"datePublic": "2024-02-08T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings."
}
],
"value": "Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-08T19:34:14.895Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade IQ Panel 4 to version 4.4.2.\u003cbr\u003e"
}
],
"value": "Upgrade IQ Panel 4 to version 4.4.2.\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade IQ4 Hub to version 4.4.2.\u003cbr\u003e"
}
],
"value": "Upgrade IQ4 Hub to version 4.4.2.\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The firmware can be updated remotely to all available devices in the field.\u003cbr\u003e"
}
],
"value": "The firmware can be updated remotely to all available devices in the field.\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The firmware update can also be manually loaded by applying the patch tag \u201ciqpanel4.4.2\u201d on the device after navigating to its firmware update page.\u003cbr\u003e"
}
],
"value": "The firmware update can also be manually loaded by applying the patch tag \u201ciqpanel4.4.2\u201d on the device after navigating to its firmware update page.\n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2024-0242",
"datePublished": "2024-02-08T19:34:14.895Z",
"dateReserved": "2024-01-04T19:27:40.165Z",
"dateUpdated": "2024-08-01T17:41:16.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.johnsoncontrols.com/cyber-solutions/security-advisories\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T17:41:16.073Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-0242\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-09T16:33:51.654700Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:36.803Z\"}}], \"cna\": {\"title\": \"Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Cody Jung\"}], \"impacts\": [{\"capecId\": \"CAPEC-212\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-212 Functionality Misuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Qolsys, Inc.\", \"product\": \"IQ Panel 4\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.4.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Qolsys, Inc.\", \"product\": \"IQ4 Hub\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.4.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade IQ Panel 4 to version 4.4.2.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade IQ Panel 4 to version 4.4.2.\u003cbr\u003e\", \"base64\": false}]}, {\"lang\": \"en\", \"value\": \"Upgrade IQ4 Hub to version 4.4.2.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade IQ4 Hub to version 4.4.2.\u003cbr\u003e\", \"base64\": false}]}, {\"lang\": \"en\", \"value\": \"The firmware can be updated remotely to all available devices in the field.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The firmware can be updated remotely to all available devices in the field.\u003cbr\u003e\", \"base64\": false}]}, {\"lang\": \"en\", \"value\": \"The firmware update can also be manually loaded by applying the patch tag \\u201ciqpanel4.4.2\\u201d on the device after navigating to its firmware update page.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The firmware update can also be manually loaded by applying the patch tag \\u201ciqpanel4.4.2\\u201d on the device after navigating to its firmware update page.\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-02-08T19:16:00.000Z\", \"references\": [{\"url\": \"https://www.johnsoncontrols.com/cyber-solutions/security-advisories\"}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"7281d04a-a537-43df-bfb4-fa4110af9d01\", \"shortName\": \"jci\", \"dateUpdated\": \"2024-02-08T19:34:14.895Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-0242\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T17:41:16.073Z\", \"dateReserved\": \"2024-01-04T19:27:40.165Z\", \"assignerOrgId\": \"7281d04a-a537-43df-bfb4-fa4110af9d01\", \"datePublished\": \"2024-02-08T19:34:14.895Z\", \"assignerShortName\": \"jci\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…