title: exacqVision Software - Improper Verification of Cryptographic Signature
description: A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
problem types: CWE-347: Improper Verification of Cryptographic Signature
affected:
{
product: exacqVision Web Service versions 20.03.2.0 and prior
vendor: Johnson Controls
versions:
lessThanOrEqual: 20.03.2.0, status: affected, version: unspecified, versionType: custom
}
{
product: exacqVision Enterprise Manager versions 20.03.3.0 and prior
vendor: Johnson Controls
versions:
lessThanOrEqual: 20.03.3.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
version: 3.1
]
solutions: Upgrade all versions of exacqVision Web Service to version 20.06.2.0 or higher
Upgrade all versions of exacqVision Enterprise Manager to version 20.06.3.0 or higher
Current users can obtain the critical software update from the Software Downloads location at https://www.exacq.com/support/downloads.php