Johnsoncontrols Openblue Enterprise Manager Data Collector vulnerabilities

2 CVEs affecting Johnsoncontrols Openblue Enterprise Manager Data Collector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-2025, published 2023-05-18.

More from Johnsoncontrols.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-2024, published 2023-05-18. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
• CVE-2023-2025, published 2023-05-18. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.