Johnson Controls Exacq Technologies exacqVision

An attacker with local user access to an exacqVision appliance could gain root control of the system, allowing them to disable video recording, modify system logs, alter recordings, or disrupt the video surveillance infrastructure that may be used for physical security monitoring.

Water utilities, municipalities, and critical infrastructure operators using exacqVision video surveillance systems should care about this vulnerability. It affects all exacqVision product lines used for physical security monitoring: Z-Series and A-Series recorders, Q-Series, G-Series, legacy LC-Series and ELP-Series systems, Network Video Recorders (NVR), C-Series Workstations, and S-Series Storage Servers. Any facility relying on exacqVision for surveillance of critical infrastructure, access points, or incident investigation is at risk.

An attacker with a low-privilege local user account on an exacqVision appliance (such as a technician or guest account) can exploit a privilege escalation flaw in the Ubuntu Linux configuration to execute commands with Super User privileges. The attack requires local shell access and moderate effort to exploit, but once successful grants complete system control.