CVE-2019-7589
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload malicious code to Johnson Controls' Kantech EntraPass systems via the SmartService API. The uploaded code executes with system-level privileges, potentially giving attackers full control. Affects Kantech EntraPass Corporate Edition and Global Edition versions 8.0 and earlier.
💻 Affected Systems
- Kantech EntraPass Corporate Edition
- Kantech EntraPass Global Edition
📦 What is this software?
Entrapass by Johnsoncontrols
Entrapass by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code with SYSTEM privileges, potentially leading to data theft, system destruction, or lateral movement within the network.
Likely Case
Remote code execution leading to installation of backdoors, credential theft, or ransomware deployment on affected access control systems.
If Mitigated
Limited impact if systems are isolated from internet and have strict network segmentation, though local network attackers could still exploit.
🎯 Exploit Status
The vulnerability is straightforward to exploit - attackers simply need to send crafted requests to the SmartService API endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 8.1 or later
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download the latest version (8.1+) from Johnson Controls support portal. 2. Backup current configuration and database. 3. Run the installer to upgrade. 4. Restart the EntraPass service or reboot the server. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable SmartService API
windowsTemporarily disable the vulnerable SmartService API service if immediate patching isn't possible
sc stop "Kantech SmartService API"
sc config "Kantech SmartService API" start= disabled
Network Segmentation
allRestrict network access to the EntraPass server to only necessary management systems
🧯 If You Can't Patch
- Isolate affected systems from internet and implement strict network segmentation
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check the EntraPass version in the application interface or via Windows Programs and Features. If version is 8.0 or earlier, the system is vulnerable.Check Version:
wmic product where "name like 'Kantech%'" get versionVerify Fix Applied:
Verify version is 8.1 or later in the application interface and confirm SmartService API is properly secured.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to SmartService API directories
- Unexpected process execution with SYSTEM privileges
- Failed authentication attempts to SmartService API
Network Indicators:
- Unusual traffic to SmartService API port (typically 443 or custom port)
- POST requests to /SmartService/Upload endpoint from unauthorized IPs
SIEM Query:
source="windows" AND (process_name="cmd.exe" OR process_name="powershell.exe") AND parent_process="Kantech SmartService API"