Our takeCISA reports a memory-extraction flaw in Johnson Controls Simplex Incident Manager that lets a local low-privilege attacker pull credentials. Update affected versions if you run it.Cyber Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- cisa_ics · cisa_ics
What this means for you — Security leader:CISA reports a vulnerability in Johnson Controls Simplex Incident Manager that lets a local low-privileged attacker extract credentials from memory. Update to a fixed version immediately if you run it.
What this means for you — Lean IT orgs:If you use Johnson Controls Simplex Incident Manager, update it now. A local attacker with limited rights could pull passwords and tokens from its memory.
What this means for you — MSP:Johnson Controls Simplex Incident Manager has a credential-theft flaw exploitable by low-privileged local users. Check every client that runs it and push the vendor's update.
What this means for you — Researcher:CISA advisory ICSA-26-232-01 details a local credential extraction vulnerability (passwords and auth tokens from memory) in Johnson Controls Simplex Incident Manager. Patch availability is the open variable.