ICSA-20-070-04_Johnson Controls Kantech EntraPass

An attacker without credentials could execute arbitrary code on the EntraPass server and gain full administrative control over physical access systems, potentially preventing authorized personnel from accessing facilities or allowing unauthorized entry.

Organizations operating Johnson Controls EntraPass physical access control systems, particularly in municipal facilities, office buildings, data centers, and other secure locations that depend on card reader access systems for building security.

An attacker on the network sends a crafted request to the EntraPass server on its management port. The server fails to properly validate input and executes arbitrary code with system privileges. From there, the attacker can modify access control policies, disable alarms, or lock out legitimate users from the building.