Victor
Monthly
Deserialization of untrusted data in Johnson Controls victor video management software (versions 2.9 up to but not including 3.0) on Windows allows an adjacent-network attacker to trigger object injection (CAPEC-586) and achieve high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector (AV:A/PR:N/UI:N) indicates unauthenticated exploitation is possible for an attacker positioned on the same local network segment, with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Deserialization of untrusted data in Johnson Controls victor video management software (versions 2.9 up to but not including 3.0) on Windows allows an adjacent-network attacker to trigger object injection (CAPEC-586) and achieve high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector (AV:A/PR:N/UI:N) indicates unauthenticated exploitation is possible for an attacker positioned on the same local network segment, with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.