CVE-2019-7594 : Exploit Details and Defense Strategies

Metasys versions prior to 9.0 by Johnson Controls have a vulnerability due to the use of a hardcoded RC2 key for encryption processes involving the Site Management Portal (SMP).

Understanding CVE-2019-7594

This CVE involves a security issue in Metasys systems that could impact confidentiality and integrity due to the use of a fixed RC2 key for encryption.

What is CVE-2019-7594?

Before version 9.0, Metasys systems utilize a hardcoded RC2 key for specific encryption processes related to the Site Management Portal (SMP).

The Impact of CVE-2019-7594

The vulnerability has a CVSS base score of 6.8, indicating a medium severity issue with high impacts on confidentiality and integrity. The attack complexity is high, requiring user interaction.

Technical Details of CVE-2019-7594

Metasys systems are affected by the following:

Vulnerability Description

The issue stems from the use of a fixed RC2 key in encryption operations involving the Site Management Portal (SMP).

Affected Systems and Versions

Product: Metasys versions prior to 9.0
Vendor: Johnson Controls
Unaffected Version: 9.0

Exploitation Mechanism

Attack Vector: Network
Privileges Required: None
User Interaction: Required
Scope: Unchanged

Mitigation and Prevention

To address CVE-2019-7594, the following steps are recommended:

Immediate Steps to Take

Upgrade Metasys devices to Release 9.0 or later
Configure sites with trusted certificates

Long-Term Security Practices

Regularly update and patch Metasys systems
Implement strong encryption practices and key management

Patching and Updates

Ensure that all Metasys devices are updated to Release 9.0 or later to mitigate the vulnerability.