Johnson Controls Illustra Essentials Gen 4 (Update A)

An attacker with high-level access to the camera could extract Linux user credentials stored on the device, potentially leading to unauthorized access to connected systems or network-wide compromise if credentials are reused.

Building security teams and facilities managers operating Johnson Controls Illustra Essentials Gen 4 IP cameras should be concerned. These cameras are typically deployed in access control, surveillance, and building automation systems across commercial facilities, hospitals, universities, and municipal infrastructure. Any system where the cameras share network infrastructure with operational technology or where admin credentials are reused across systems is at heightened risk.

An attacker must first gain high-privilege access to the Illustra Essentials Gen 4 camera (e.g., through compromised administrative credentials or lateral movement from another compromised device). Once authenticated at the admin level, the attacker can read credential files from the Linux filesystem that stores user account information, allowing them to harvest plaintext or weakly encrypted passwords.