Advms
Monthly
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.