title: IQ Wifi 6
description: An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.
problem types: CWE-307 Improper Restriction of Excessive Authentication Attempts
affected:
{
defaultStatus: unaffected
product: IQ Wifi 6
vendor: Johnson Controls
versions:
lessThan: 2.0.2, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade IQ Wifi 6 firmware to version 2.0.2.
The firmware update will be pushed to all available devices in the field.
The firmware update can also be manually loaded by applying the patch tag “iqwifi2.0.2” on the device after navigating to its firmware update page.