Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.

Summary

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.

Remediation

1. Inventory every Johnson Controls Kantech Entrapass deployment, including staging.
2. Upgrade Johnson Controls Kantech Entrapass to 9.20.
3. Confirm the running version after the upgrade.

References

• Referencehttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories