CVE-2024-32863 Johnson Controls, Inc. CVE debrief

Who should care

Organizations operating Johnson Controls exacqVision video management systems, particularly security operations centers, critical infrastructure facilities, and enterprises using exacqVision for physical security and surveillance. System administrators responsible for exacqVision Web Service deployments and security teams managing ICS/OT environments should prioritize assessment and patching.

Technical summary

The vulnerability exists in the web service component of Johnson Controls exacqVision video management system. Affected versions through 24.03 fail to properly validate or enforce anti-CSRF tokens on state-changing requests, allowing an attacker to craft malicious requests that execute with the privileges of an authenticated administrative session. Successful exploitation requires the attacker to induce an authenticated administrator to interact with malicious content (e.g., visit a crafted webpage or click a malicious link). The attack complexity is rated high due to required user interaction, but the impact includes high confidentiality and integrity compromise through administrative privilege abuse. No availability impact is associated with this vulnerability.

Defensive priority

medium

Recommended defensive actions

• Update exacqVision Web Service to version 24.06 or later per vendor guidance
• Review Johnson Controls Product Security Advisory JCI-PSA-2024-16 for detailed mitigation instructions
• Implement network segmentation to limit exposure of exacqVision Web Service interfaces
• Apply defense-in-depth strategies for industrial control systems per CISA guidance
• Monitor for anomalous administrative activity in exacqVision Web Service logs

Evidence notes

CISA CSAF advisory ICSA-24-214-03 published 2024-08-01 identifies affected product as exacqVision Web Service versions 24.03 and prior. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N confirms network attack vector with high complexity and required user interaction. Vendor fix available in version 24.06 per remediation guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.