Cleartext storage of sensitive information in Johnson Controls Software House C•CURE 9000…
Priority MEDIUM 44CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.
Why it matters now
EPSS 0.0099 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnson Controls | Software House C•CURE 9000 v2.70 | 2.70 | — | No fix listed | CNA |
| Johnson Controls | American Dynamics victor Video Management System v5.2 | 5.2 | — | No fix listed | CNA |
- Software House C•CURE 9000 v2.70 VendorJohnson Controls Affected 2.70 Fixed in — No fix listed CNA
- American Dynamics victor Video Management System v5.2 VendorJohnson Controls Affected 5.2 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tyco:victor_video_management_system:5.2:*:*:*:*:*:*:* | 5.2 | Vulnerable | Tyco |
| cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:2.70:*:*:*:*:*:*:* | 2.70 | Vulnerable | Johnson Controls |
- cpe:2.3:a:tyco:victor_video_management_system:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Tyco
- cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:2.70:*:*:*:*:*:*:* Versions 2.70 Vulnerable ·Johnson Controls
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9045
- 2026-10-03 Alias added: GHSA-389j-cw3h-6fc8
References
More Johnson Controls C-cure 9000 Firmware vulnerabilities
- TI-2021-09108 Improper input validation in Johnson Controls C-CURE 9000 CVSS 3.1HIGH 8.8
- TI-2021-14617 CCURE Observable Response Discrepancy CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-9045 · CVE Program
- CVE-2020-9045 · NVD
- FIRST EPSS
- GHSA-389j-cw3h-6fc8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences