Analysis Summary

CVE-2024-32752

Johnson Controls iSTAR Pro and ICU is vulnerable to a man-in-the-middle attack, caused by missing authentication for critical function. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to cause impact to door control and configuration.

Impact

• Gain Access

Indicators of Compromise

CVE

• CVE-2024-32752

Affected Vendors

Affected Products

• Johnson Controls ICU
• Johnson Controls iSTAR Pro

Remediation

Refer to Johnson Controls Product Security Advisory for patch, upgrade or suggested workaround information.

Johnson Controls Product Security Advisory