Victor Web
Monthly
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required.
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required.