title: Kantech EntraPass Security Management Software - System Permissions Vulnerability
description: A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.
problem types: CWE-284 : Access Control (Authorization) Issues
affected:
{
product: Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior
vendor: Johnson Controls
versions:
lessThanOrEqual: 8.22, status: affected, version: unspecified, versionType: custom
}
{
product: Kantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior
vendor: Johnson Controls
versions:
lessThanOrEqual: 8.22, status: affected, version: unspecified, versionType: custom
}
{
product: Kantech EntraPass Security Management Software Global Edition versions 8.22 and prior
vendor: Johnson Controls
versions:
lessThanOrEqual: 8.22, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: Upgrade all Kantech EntraPass Editions to version 8.23.
Registered users can obtain the critical software update by downloading the zip file from the Software Downloads location at https://kantech.com/Support/SoftwareDownloads.aspx.