CVE-2024-0242
📋 TL;DR
CVE-2024-0242 is an information exposure vulnerability in Johnson Controls IQ Panel4 and IQ4 Hub security panel software that could allow unauthorized access to system settings. This affects organizations using these security panels for physical access control and building management. The vulnerability occurs under certain unspecified circumstances in software versions prior to 4.4.2.
💻 Affected Systems
- Johnson Controls IQ Panel4
- Johnson Controls IQ4 Hub
📦 What is this software?
Qolsys Iq Panel 4 Firmware by Johnsoncontrols
Qolsys Iq4 Hub Firmware by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized access to security panel settings, potentially disabling alarms, modifying access controls, or compromising the entire physical security system.
Likely Case
Unauthorized users could view sensitive configuration data, potentially enabling further attacks or reconnaissance of the security system.
If Mitigated
With proper network segmentation and access controls, impact would be limited to unauthorized viewing of configuration data without ability to modify settings.
🎯 Exploit Status
Exploitation requires specific circumstances and likely some level of access to the system or network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.2
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Contact Johnson Controls support or authorized dealer
2. Schedule maintenance window for panel update
3. Apply software update to version 4.4.2
4. Verify successful update and functionality
🔧 Temporary Workarounds
Network Segmentation
allIsolate security panels on separate VLAN with strict access controls
Access Control Lists
allImplement strict firewall rules limiting access to panel management interfaces
🧯 If You Can't Patch
- Segment panels on isolated network with no internet access
- Implement strict physical access controls to panel locations
🔍 How to Verify
Check if Vulnerable:
Check panel software version via local interface or management softwareCheck Version:
Check via panel local interface or Johnson Controls management softwareVerify Fix Applied:
Confirm software version is 4.4.2 or later📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to panel management interfaces
- Unexpected configuration changes
Network Indicators:
- Unusual traffic patterns to/from security panel IP addresses
- Unauthorized connection attempts to panel management ports
SIEM Query:
source_ip IN (panel_ips) AND (event_type='access_denied' OR event_type='configuration_change')