CVE-2024-32758: 
exacqVision Client vulnerability analysis and mitigation

CVE-2024-32758 is a security vulnerability affecting the communication between exacqVision Client and exacqVision Server. The vulnerability was discovered and disclosed in August 2024, impacting all versions of exacqVision client and server up to (excluding) version 24.06. The core issue involves insufficient key length and exchange during communication between these components (CISA Advisory, NVD).

The vulnerability has been assigned CWE-326 (Inadequate Encryption Strength). It received a CVSS v4.0 base score of 9.0 CRITICAL (Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability specifically relates to insufficient encryption strength in the communication protocol between the client and server components (NVD).

Successful exploitation of this vulnerability could allow an attacker to decrypt communications between exacqVision Server and exacqVision Client due to the insufficient key length and exchange. This affects critical infrastructure sectors including Critical Manufacturing, Commercial Facilities, Government Facilities, Transportation Systems, and Energy sectors, with worldwide deployment (CISA Advisory).

The vulnerability has a high attack complexity according to the CVSS scoring. No known public exploitation specifically targeting this vulnerability has been reported to CISA at the time of disclosure (CISA Advisory).

Johnson Controls recommends users update exacqVision Client and exacqVision Server to version 24.06. Additionally, users should follow the guidance provided in the exacqVision Hardening Guide under the Password Strengthening section. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls isolated from business networks (CISA Advisory).