« Volver al listado

CVE-2020-9045

Estado: ModificadaMedia (6.5)—

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Johnsoncontrols — C-cure 9000 FirmwareTyco — Victor Video Management System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9045",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "productsecurity@jci.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@jci.com",
      "affectedData": [
        {
          "vendor": "Johnson Controls",
          "product": "Software House C•CURE 9000 v2.70",
          "versions": [
            {
              "status": "affected",
              "version": "2.70"
            }
          ]
        },
        {
          "vendor": "Johnson Controls",
          "product": "American Dynamics victor Video Management System v5.2",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-21T15:15:10.013",
  "references": [
    {
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-142-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/ICSA-20-142-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@jci.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation."
    },
    {
      "lang": "es",
      "value": "Durante la instalación o actualización del Software House C-CURE 9000 versión v2.70 y American Dynamics victor Video Management System versión v5.2, las credenciales del usuario usadas para llevar a cabo la instalación o actualización son registradas en un archivo. El archivo de registro de instalación persiste después de la instalación."
    }
  ],
  "lastModified": "2026-06-17T03:27:23.877",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tyco:victor_video_management_system:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEB8E462-891E-4774-AC44-11A7649596BE"
            },
            {
              "criteria": "cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:2.70:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3170F44C-A69B-4727-A04E-D3A041C95634"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productsecurity@jci.com"
}