CVE-2020-9047 - CVE House
Back to Database
Status published Medium CVE-2020-9047

exacqVision Software - Improper Verification of Cryptographic Signature

Vulnerability Description

A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-9047

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Michael Norris

References

More from Johnson Controls

View All →
CVE-2025-61740
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
High 7.2
CVE-2025-61739
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
High 7.2
CVE-2025-61738
Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
Low 2.3
CVE-2025-61736
iSTAR- Improper Validation of Certificate Expiration
High 7.1
CVE-2025-43876
iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
High 8.7

Affected Vendor

Johnson Controls

View all reports →

Affected Software

exacqVision Web Service versions 20.03.2.0 and prior, exacqVision Enterprise Manager versions 20.03.3.0 and prior
Vulnerable Versions:
unspecified

Timeline

Official Publish: June 26th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L

Weaknesses (CWE)

CWE-347

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1565 Data Manipulation
Impact