CVE-2023-3548
📋 TL;DR
This vulnerability allows unauthorized users to gain account access to IQ Wifi 6 devices by conducting brute force authentication attacks. Attackers can systematically guess credentials to compromise accounts. Affected systems are IQ Wifi 6 versions prior to 2.0.2.
💻 Affected Systems
- Johnson Controls IQ Wifi 6
📦 What is this software?
Iq Wifi 6 Firmware by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the IQ Wifi 6 device, allowing attackers to reconfigure network settings, intercept traffic, or use the device as a foothold into the broader network.
Likely Case
Unauthorized access to administrative accounts, enabling attackers to modify device configurations, disrupt network connectivity, or gather sensitive information.
If Mitigated
Limited or no impact if strong authentication controls, account lockout policies, and network segmentation are properly implemented.
🎯 Exploit Status
Brute force attacks are well-understood and easily automated. No authentication required to attempt attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download firmware version 2.0.2 from Johnson Controls support portal. 2. Backup current configuration. 3. Apply firmware update through device management interface. 4. Reboot device. 5. Verify successful update.
🔧 Temporary Workarounds
Implement Account Lockout Policy
allConfigure the device to lock accounts after multiple failed login attempts.
Network Segmentation
allIsolate IQ Wifi 6 devices on separate VLANs with strict firewall rules limiting access.
🧯 If You Can't Patch
- Implement network-based rate limiting to restrict authentication attempts
- Deploy intrusion detection systems to monitor for brute force patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in administration interface. If version is below 2.0.2, device is vulnerable.Check Version:
Check via device web interface or SSH: show version or system infoVerify Fix Applied:
Confirm firmware version shows 2.0.2 or higher in device administration interface.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single IP
- Successful logins from unusual IP addresses
- Account lockout events
Network Indicators:
- High volume of authentication requests to device management ports
- Traffic patterns showing systematic credential guessing
SIEM Query:
source="iqwifi6" AND (event_type="auth_failure" count>10 within 5min) OR (event_type="auth_success" AND src_ip NOT IN allowed_ips)