Full Report
[Control systems] Johnson Controls security advisory (AV26-1052)
Analysis Summary
# Vulnerability: Authentication Bypass in American Dynamics VMS (ADVMS)
## CVE Details
- **CVE ID:** CVE-2024-41916 (Associated with JCI-PSA-2026-17)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication)
## Affected Systems
- **Products:** American Dynamics Video Management System (ADVMS)
- **Versions:** All versions prior to 3.10
- **Configurations:** Systems utilizing the web-based management interface.
## Vulnerability Description
A critical vulnerability exists in the authentication mechanism of the American Dynamics VMS. The flaw allows an unauthenticated remote attacker to bypass security restrictions by sending specially crafted requests to the application. This occurs due to improper validation of authentication tokens or session management, potentially allowing the attacker to gain full administrative access to the VMS platform.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; no public PoC currently identified.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to video feeds and user data)
- **Integrity:** High (Ability to modify configurations or delete footage)
- **Availability:** High (Potential to disable the surveillance system)
## Remediation
### Patches
- **ADVMS Version 3.10:** Users are strongly advised to upgrade to version 3.10 or later to resolve this vulnerability.
### Workarounds
- **Network Segmentation:** Isolate the VMS network from the public internet and untrusted internal networks.
- **Access Control Lists (ACLs):** Restrict access to the ADVMS management interface to specific authorized IP addresses only.
- **VPN usage:** Require a secure VPN with Multi-Factor Authentication (MFA) for any remote administrative access.
## Detection
- **Indicators of Compromise:** Monitor web server logs for unusual status codes or unauthorized access attempts to administrative endpoints.
- **Detection methods and tools:** Audit user account creation logs and configuration change history within the ADVMS dashboard for unauthorized modifications.
## References
- **Vendor Advisory:** hxxps[://]tyco[.]widen[.]net/s/zwdfjrxcnw/jci-psa-2026-17
- **Johnson Controls Trust Center:** hxxps[://]www[.]johnsoncontrols[.]com/trust-center/cybersecurity/security-advisories
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/control-systems-johnson-controls-security-advisory-av26-1052