Johnson Controls exacqVision Client and exacqVision Server contain an inadequate encryption strength vulnerability that could allow an attacker to be able to decrypt communications between exacqVision Server and exacqVision Client due to insufficient key length and exchange.

Sources: CISA, Johnson Controls

Johnson Controls exacqVision Web Service contains a permissive cross-domain policy with untrusted domains vulnerability that could allow an attacker to send an unauthorized request or access data from an untrusted domain.

Sources: CISA, Johnson Controls

Johnson Controls exacqVision Server contains an improper certificate validation vulnerability that could allow an attacker to perform a man-in-the-middle attack and intercept communications.

Sources: CISA, Johnson Controls

AVTECH IP Camera contains a command injection vulnerability that could allow an attacker to inject and execute commands as the owner of the running process.

Sources: CISA, AVTECH

Vonets WiFi Bridges contain use of hard-coded credentials, improper access control, path traversal, command injection and other vulnerabilities that could allow an attacker to disclose sensitive information, cause a denial-of-service condition or execute arbitrary code on the affected device.

Sources: CISA, Vonets

Rockwell Automation Logix Controllers contain an unprotected alternate channel vulnerability that could allow an attacker to execute CIP programming and configuration commands.

Sources: CISA, Rockwell Automation