What’s Vulnerable › Vulnerabilities

CVE-2024-32754: Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information

• Severity: low (CVSS 3.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-04 · updated 2026-06-17
• Weakness: CWE-200

Description

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.

Affected products

• Johnson Controls Kantech KT1 Door Controller, Rev01: through 2.09.10
• Johnson Controls Kantech KT2 Door Controller, Rev01: through 2.09.10
• Johnson Controls Kantech KT400 Door Controller, Rev01: through 3.01.16

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2024-32754 or the next vulnerability affects your stack