Read the docs
TI-2023-04421 Aliases CVE-2023-4804GHSA-vw8q-rcfx-xf52

An unauthorized user could access debug features in Quantum HD Unity products that were…

Priority MEDIUM 50CWE-489Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Fix Fixed Quantum HD Unity Compressor (Johnson Controls): 11.22, 12.22Quantum HD Unity AcuAir (Johnson Controls): 11.12, 12.12+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Johnson ControlsQuantum HD Unity Compressorbefore 11.22; before 12.2211.22, 12.22Patch availableCNA
Johnson ControlsQuantum HD Unity AcuAirbefore 11.12; before 12.1211.12, 12.12Patch availableCNA
Johnson ControlsQuantum HD Unity Condenser/Vesselbefore 11.11; before 12.1111.11, 12.11Patch availableCNA
Johnson ControlsQuantum HD Unity Evaporatorbefore 11.11; before 12.1111.11, 12.11Patch availableCNA
Johnson ControlsQuantum HD Unity Engine Roombefore 11.11; before 12.1111.11, 12.11Patch availableCNA
Johnson ControlsQuantum HD Unity Interfacebefore 11.11; before 12.1111.11, 12.11Patch availableCNA
  • Quantum HD Unity Compressor VendorJohnson Controls Affected before 11.22; before 12.22 Fixed in 11.22, 12.22 Patch available CNA
  • Quantum HD Unity AcuAir VendorJohnson Controls Affected before 11.12; before 12.12 Fixed in 11.12, 12.12 Patch available CNA
  • Quantum HD Unity Condenser/Vessel VendorJohnson Controls Affected before 11.11; before 12.11 Fixed in 11.11, 12.11 Patch available CNA
  • Quantum HD Unity Evaporator VendorJohnson Controls Affected before 11.11; before 12.11 Fixed in 11.11, 12.11 Patch available CNA
  • Quantum HD Unity Engine Room VendorJohnson Controls Affected before 11.11; before 12.11 Fixed in 11.11, 12.11 Patch available CNA
  • Quantum HD Unity Interface VendorJohnson Controls Affected before 11.11; before 12.11 Fixed in 11.11, 12.11 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_compressor_firmware:*:*:*:*:*:*:*:*11.00 to before 11.22; 12.00 to before 12.22VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_compressor:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_acuair_firmware:*:*:*:*:*:*:*:*11.00 to before 11.12; 12.00 to before 12.12VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_acuair:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_condenser\/vessel_firmware:*:*:*:*:*:*:*:*11.00 to before 11.11; 12.00 to before 12.11VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_condenser\/vessel:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_evaporator_firmware:*:*:*:*:*:*:*:*11.00 to before 11.11; 12.00 to before 12.11VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_evaporator:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_engine_room_firmware:*:*:*:*:*:*:*:*11.00 to before 11.11; 12.00 to before 12.11VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_engine_room:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_compressor_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.22; 12.00 to before 12.22 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_compressor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_acuair_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.12; 12.00 to before 12.12 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_acuair:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_condenser\/vessel_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.11; 12.00 to before 12.11 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_condenser\/vessel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_evaporator_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.11; 12.00 to before 12.11 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_evaporator:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_engine_room_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.11; 12.00 to before 12.11 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_engine_room:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:johnsoncontrols:quantum_hd_unity_interface_firmware:*:*:*:*:*:*:*:*11.00 to before 11.11; 12.00 to before 12.11VulnerableJohnson Controls
cpe:2.3:h:johnsoncontrols:quantum_hd_unity_interface:-:*:*:*:*:*:*:*not specified by NVDRunning onJohnson Controls
  • cpe:2.3:o:johnsoncontrols:quantum_hd_unity_interface_firmware:*:*:*:*:*:*:*:* Versions 11.00 to before 11.11; 12.00 to before 12.11 Vulnerable ·Johnson Controls
  • cpe:2.3:h:johnsoncontrols:quantum_hd_unity_interface:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls

Remediation

  • Fix · CNA Quantum HD Unity Compressor (Johnson Controls) Fixed in 11.22, 12.22
  • Fix · CNA Quantum HD Unity AcuAir (Johnson Controls) Fixed in 11.12, 12.12
  • Fix · CNA Quantum HD Unity Condenser/Vessel (Johnson Controls) Fixed in 11.11, 12.11
  • Fix · CNA Quantum HD Unity Evaporator (Johnson Controls) Fixed in 11.11, 12.11
  • Fix · CNA Quantum HD Unity Engine Room (Johnson Controls) Fixed in 11.11, 12.11
  • Fix · CNA Quantum HD Unity Interface (Johnson Controls) Fixed in 11.11, 12.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4804
  2. 2026-10-03 Alias added: GHSA-vw8q-rcfx-xf52

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences