VULNERABILITY INTELLIGENCE

CVE-2019-7589

CVSS score9.8 CRITICAL

EPSS probability1.60%

CISA KEVNot currently listed

Published2020-03-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.

Weakness classification

CWE-20: Improper Input Validation

Primary references

productsecurity@jci.com — Vendor Advisory
productsecurity@jci.com — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource