CVE-2020-9047

published 2020-06-26

CVE-2020-9047: A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions…

Priority P2 58 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
johnson_controls	exacqvision_enterprise_manager_versions_20.03.3.0_and_prior	unspecified – 20.03.3.0	—
johnson_controls	exacqvision_web_service_versions_20.03.2.0_and_prior	unspecified – 20.03.2.0	—
johnsoncontrols	exacqvision_enterprise_manager	<= 20.06.4.0	—
johnsoncontrols	exacqvision_web_service	<= 20.06.3.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /version.web

version 3.10.4.72058

version 3.12.4.76544

version 3.8.2.67295

version 7.0.2.81005

version 7.2.7.86974

version 7.4.3.89785

version 7.6.4.94391

version 7.8.2.97826

version 8.0.6.105408

version 8.2.2.107285

version 8.4.3.111614

version 8.6.3.116175

version 8.8.1.118913

version 9.0.3.124620

version 9.2.0.127940

version 9.4.3.137684

version 9.6.7.145949

version 9.8.4.149166

version 19.03.3.152166

version 19.06.4.157118

version 19.09.4.0

version 19.12.2.0

version 20.03.2.0

version 20.06.3.0

bytes

490a0046304402204ea40c18e027a46a275355e5f3f7a78cfadc8de3416cc1c3d0ef1dbc7361237102200e3fc4a4cb5bdf42af2078683037cce8b3cffdb4faab1b32261827513b6a500d:922c64590222798bb761d5b6d8e72950

• → The version disclosure endpoint /version.web returns a plaintext build string; match the response body against the enumerated vulnerable version list to identify affected hosts.
• → Root cause is CWE-347 (Improper Verification of Cryptographic Signature): the web service does not verify signatures on downloaded executables, enabling an admin-level attacker to stage a malicious binary for OS command injection. ↗

• · Exploitation requires administrative privileges on the exacqVision Web Service; the attack vector is network-accessible but privilege requirement is HIGH (PR:H), limiting opportunistic exploitation. ↗
• · CISA's CVSS v3 score (6.8, AV:N/AC:H/PR:H/UI:R/S:C) differs from the Nuclei template score (7.2, AV:N/AC:L/PR:H/UI:N/S:U); detection confidence should account for the higher attack complexity and required user interaction noted by CISA. ↗
• · No known public exploits specifically targeting this vulnerability were confirmed at time of advisory publication; high skill level is needed to exploit. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-347