Kantech EntraPass EUVD-2026-109980

Exploitation requires low-privilege access on the Kantech Entrapass system and a local attack vector (AV:L/PR:L/UI:N per the vendor CVSS 4.0 vector), meaning the attacker must already be authenticated or have local footing rather than acting as a remote unauthenticated attacker. The underlying condition is the product's use of a hard-coded cryptographic key (CWE-321), which lets an attacker interact with the encryption as a padding oracle; the specific feature, protocol message, or stored data that forms the oracle is not described in the available sources. Limiting factors: all versions before 9.20 are affected and updating to 9.20 removes the condition; the local vector and required privileges substantially constrain remote or automated exploitation.

This is a genuinely serious but access-gated issue, not a drive-by remote threat. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.5 and describes a locally-vectored attack requiring low-level privileges (PR:L) and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H) and no subsequent-system scope change. The high score is driven by impact, not by ease of reach: because AV:L and PR:L require an attacker who already has local/authenticated footing on the Entrapass host, this is not internet-automatable mass-exploitation material. No EPSS probability was provided in the input, so exploitation likelihood cannot be quantified here. The vulnerability is not listed in CISA KEV (no KEV signal in input), and no public exploit or PoC reference is present - only a vendor advisory landing page. The vuln.today decision label is 'this_week', consistent with a high-impact, privilege-gated flaw that warrants prompt but not emergency remediation. Note the CWE (CWE-321, hard-coded cryptographic key) combined with the stated 'Padding Oracle Crypto Attack' implies the weakness is in how encrypted data is protected; the exact trigger and what data the oracle exposes are not described in the available sources - verify specifics with the Johnson Controls advisory.

An attacker with low-privilege local or authenticated access to a Kantech Entrapass installation abuses the embedded hard-coded cryptographic key to mount a padding oracle attack against data the product encrypts, decrypting or forging protected values. No public exploit code or PoC reference is present in the input, so this scenario is inferred from the CWE-321 weakness and the vendor-stated attack type rather than from a demonstrated exploit. The local attack vector (AV:L) means the attacker must first have access to the system.