As cited
Copy frozen at (site build).
vulnerabilities
Johnson Controls Inc. Airwall
Johnson Controls Inc. Airwall versions 4.0.4 and earlier contain two critical vulnerabilities: a hardcoded cryptographic key that is identical across all installations, enabling decryption of sensitive data, and an arbitrary file read flaw that permits attackers to access arbitrary files on affected systems. The vendor recommends upgrading to version 4.1.0 or later and implementing secure key management practices.
Why it matters: Organizations running Airwall in critical infrastructure (manufacturing, energy, transportation, government facilities) must patch immediately, as the hardcoded key affects all deployments globally and exposes configuration files, credentials, and private keys to any attacker with code access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Johnson Controls Inc. Airwall
Johnson Controls Inc. Airwall versions 4.0.4 and earlier contain two critical vulnerabilities: a hardcoded cryptographic key that is identical across all installations, enabling decryption of sensitive data, and an arbitrary file read flaw that permits attackers to access arbitrary files on affected systems. The vendor recommends upgrading to version 4.1.0 or later and implementing secure key management practices.
Why it matters: Organizations running Airwall in critical infrastructure (manufacturing, energy, transportation, government facilities) must patch immediately, as the hardcoded key affects all deployments globally and exposes configuration files, credentials, and private keys to any attacker with code access.
- Source published
- First seen by Cybersecurity Tracker