CVE-2023-4804

An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.

Score

CVSS 3.1 10.0 Critical

Status

Modified - productsecurity@jci.com

Published

2023-11-10

Last modified

2025-12-16

Weaknesses

CWE-489

Affected products

• Quantum Hd Unity Acuair (Johnson Controls)
• Quantum Hd Unity Compressor (Johnson Controls)
• Quantum Hd Unity Condenservessel (Johnson Controls)
• Quantum Hd Unity Engine Room (Johnson Controls)
• Quantum Hd Unity Evaporator (Johnson Controls)
• Quantum Hd Unity Interface (Johnson Controls)
• Quantum Hd Unity Acuair Firmware (Johnsoncontrols)
• Quantum Hd Unity Compressor Firmware (Johnsoncontrols)
• Quantum Hd Unity Condenser/vessel Firmware (Johnsoncontrols)
• Quantum Hd Unity Engine Room Firmware (Johnsoncontrols)
• Quantum Hd Unity Evaporator Firmware (Johnsoncontrols)
• Quantum Hd Unity Interface Firmware (Johnsoncontrols)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories