Simplex Incident Manager Autocall Fire Administrator
Monthly
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.