Kantech Entrapass
Monthly
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Kantech Entrapass before 9.20 stores embedded sensitive information in cleartext in memory, so an actor with local access, high-level host privileges, and the required user interaction can retrieve that data. The issue is rated CVSS 5.3 and assessed as a moderate, low-urgency information-disclosure risk rather than a remote compromise path, because exploitation depends on pre-existing privileged local access and realistic exposure is confined to insiders or post-compromise situations. Vendor patching is available (upgrade to 9.20 or later); no public exploit identified at time of analysis.
Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Kantech Entrapass before 9.20 stores embedded sensitive information in cleartext in memory, so an actor with local access, high-level host privileges, and the required user interaction can retrieve that data. The issue is rated CVSS 5.3 and assessed as a moderate, low-urgency information-disclosure risk rather than a remote compromise path, because exploitation depends on pre-existing privileged local access and realistic exposure is confined to insiders or post-compromise situations. Vendor patching is available (upgrade to 9.20 or later); no public exploit identified at time of analysis.
Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.