CVE-2024-32865
📋 TL;DR
CVE-2024-32865 is a TLS certificate validation vulnerability in exacqVision Server that allows man-in-the-middle attacks when connecting to devices. Attackers can intercept or manipulate communications between the server and connected devices. This affects organizations using exacqVision Server for video surveillance and security systems.
💻 Affected Systems
- exacqVision Server
📦 What is this software?
Exacqvision Server by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept video feeds, manipulate camera controls, inject malicious data, or gain unauthorized access to the surveillance network.
Likely Case
Man-in-the-middle attacks allowing interception of video streams and metadata, potentially exposing sensitive surveillance footage.
If Mitigated
Limited impact with proper network segmentation and certificate validation controls in place.
🎯 Exploit Status
Requires man-in-the-middle position between server and devices. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.12.3.0 and later
Vendor Advisory: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Restart Required: Yes
Instructions:
1. Download exacqVision Server version 22.12.3.0 or later from Johnson Controls support portal. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the exacqVision Server service.
🔧 Temporary Workarounds
Network Segmentation
allIsolate exacqVision Server and connected devices on separate VLAN to limit attack surface
Certificate Pinning
allImplement certificate pinning for critical devices if supported by configuration
🧯 If You Can't Patch
- Segment network to isolate exacqVision Server from untrusted networks
- Monitor network traffic for unexpected TLS certificate changes or man-in-the-middle patterns
🔍 How to Verify
Check if Vulnerable:
Check exacqVision Server version in administration interface. Versions below 22.12.3.0 are vulnerable.Check Version:
Check via exacqVision Server web interface: Admin > System > AboutVerify Fix Applied:
Verify version is 22.12.3.0 or higher in administration interface and test TLS connections to devices.📡 Detection & Monitoring
Log Indicators:
- Failed TLS handshake logs
- Certificate validation errors
- Unexpected device connection attempts
Network Indicators:
- Unexpected TLS certificate changes between server and devices
- Man-in-the-middle patterns in network traffic
SIEM Query:
source="exacqvision" AND (event_type="tls_error" OR certificate_validation="failed")