CVE-2020-9045
📋 TL;DR
This vulnerability exposes installation credentials in plaintext log files during installation or upgrade of affected security systems. Attackers who gain access to these log files can steal administrative credentials, potentially compromising the entire security system. This affects organizations using Software House C•CURE 9000 v2.70 or American Dynamics victor Video Management System v5.2.
💻 Affected Systems
- Software House C•CURE 9000
- American Dynamics victor Video Management System
📦 What is this software?
C Cure 9000 Firmware by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where attackers gain administrative access, disable security systems, manipulate access controls, and potentially pivot to other network systems.
Likely Case
Credential theft leading to unauthorized access to security management systems, allowing attackers to view surveillance footage, modify access permissions, or disable security features.
If Mitigated
Limited impact if logs are properly secured and monitored, with attackers unable to access the credential files.
🎯 Exploit Status
Exploitation requires file system access to read the installation log file. No special tools or techniques needed beyond basic file reading.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: C•CURE 9000 v2.80 and later, victor Video Management System v5.3 and later
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download updated software from Johnson Controls support portal. 2. Backup current configuration. 3. Run installer with administrative privileges. 4. Follow upgrade wizard. 5. Verify installation and remove old log files.
🔧 Temporary Workarounds
Secure Installation Log Files
allManually locate and secure installation log files after installation/upgrade
find /path/to/installation -name "*.log" -type f -exec chmod 600 {} \;
find /path/to/installation -name "*.log" -type f -exec rm -f {} \;
Restrict File System Access
linuxApply strict file permissions to installation directories
chmod -R 750 /opt/ccure9000
chown -R root:security /opt/ccure9000
🧯 If You Can't Patch
- Immediately locate and delete all installation log files containing credentials
- Implement strict access controls and monitoring on installation directories
🔍 How to Verify
Check if Vulnerable:
Check for installation log files in default installation directories (typically C:\Program Files\C-CURE 9000 or similar) and search for plaintext credentialsCheck Version:
Check application About dialog or run: C-CURE 9000: Check Help > About; victor VMS: Check System Information in admin interfaceVerify Fix Applied:
Verify software version is v2.80+ for C•CURE 9000 or v5.3+ for victor VMS, and confirm no plaintext credentials exist in log files📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to installation directories
- File read operations on installation log files
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual administrative access patterns
- Access from unexpected IP addresses to management interfaces
SIEM Query:
source="windows_security" EventID=4663 ObjectName="*install*.log" OR source="sysmon" EventID=11 TargetFilename="*install*.log"