CVE-2023-2024

Improper Authentication for OpenBlue Enterprise Manager Data Collector

Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.

Affected

Johnson Controls · OpenBlue Enterprise Manager Data Collector

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 JCI

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS

1.09% chance of exploitation in the next 30 days, 65th percentile

Published

2023-05-18

Updated

2025-02-12

Proof-of-concept exploits (1)

• team890/CVE-2023-20241★ · 2024-05-30

Security advisories

• https://www.johnsoncontrols.com/cyber-solutions/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04

References

• CVE Record
• NVD entry