CVE-2023-4804
Critical
Description
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
SeverityCritical
CVSS10.0
Exploit probability—
ProductJohnsoncontrols Quantum Hd Unity Compressor Firmware
PublishedNov 10, 2023
First seenNov 10, 2023
Weakness typeCWE-489CWE-489
How to fix
Update
- johnsoncontrols quantum_hd_unity_compressor_firmware11.22, 12.22 or later
- johnsoncontrols quantum_hd_unity_acuair_firmware11.12, 12.12 or later
- johnsoncontrols quantum_hd_unity_condenser\/vessel_firmware11.11, 12.11 or later
- johnsoncontrols quantum_hd_unity_evaporator_firmware11.11, 12.11 or later
- johnsoncontrols quantum_hd_unity_engine_room_firmware11.11, 12.11 or later
- johnsoncontrols quantum_hd_unity_interface_firmware11.11, 12.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| johnsoncontrols quantum_hd_unity_compressor_firmware | 11.00 ≤ v < 11.22, 12.00 ≤ v < 12.22 | 11.22, 12.22 |
| johnsoncontrols quantum_hd_unity_acuair_firmware | 11.00 ≤ v < 11.12, 12.00 ≤ v < 12.12 | 11.12, 12.12 |
| johnsoncontrols quantum_hd_unity_condenser\/vessel_firmware | 11.00 ≤ v < 11.11, 12.00 ≤ v < 12.11 | 11.11, 12.11 |
| johnsoncontrols quantum_hd_unity_evaporator_firmware | 11.00 ≤ v < 11.11, 12.00 ≤ v < 12.11 | 11.11, 12.11 |
| johnsoncontrols quantum_hd_unity_engine_room_firmware | 11.00 ≤ v < 11.11, 12.00 ≤ v < 12.11 | 11.11, 12.11 |
| johnsoncontrols quantum_hd_unity_interface_firmware | 11.00 ≤ v < 11.11, 12.00 ≤ v < 12.11 | 11.11, 12.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.