Back to Database
Status published
Low
CVE-2024-32754
Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information
Vulnerability Description
Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32754
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- National Computer Emergency Response Team (CERT) of India
References
More from Johnson Controls
View All →CVE-2025-61740
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
High
7.2
CVE-2025-61739
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
High
7.2
CVE-2025-61738
Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
Low
2.3
CVE-2025-61736
iSTAR- Improper Validation of Certificate Expiration
High
7.1
CVE-2025-43876
iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
High
8.7
Affected Vendor
Johnson Controls
View all reports →Affected Software
Kantech KT1 Door Controller, Rev01, Kantech KT2 Door Controller, Rev01, Kantech KT400 Door Controller, Rev01
Vulnerable Versions:
0
Timeline
Official Publish:
July 4th, 2024
Last Modified:
August 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N