What’s Vulnerable › Vulnerabilities

CVE-2024-32932: American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-02 · updated 2026-06-17
• Weakness: CWE-257

Description

Under certain circumstances the web interface users credentials may be recovered by an authenticated user.

Affected products

• Johnsoncontrols Illustra Essential Gen 4 Firmware: before Illustra.Ess4.01.02.13.6953 — fixed in Illustra.Ess4.01.02.13.6953

How to fix

Upgrade to a fixed version: Johnsoncontrols Illustra Essential Gen 4 Firmware Illustra.Ess4.01.02.13.6953. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2024-32932 or the next vulnerability affects your stack