CVE-2024-0242: Qolsys IQ Panel 4 Auth Bypass Vulnerability

CVE-2024-0242 Overview

CVE-2024-0242 is a critical vulnerability affecting Johnson Controls Qolsys IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2. Under certain circumstances, this vulnerability could allow unauthorized access to device settings, potentially compromising the security and functionality of these home and building automation security panels.

This vulnerability falls under the category of Improper Access Control, allowing attackers to bypass authentication mechanisms and gain access to protected system settings. Given that these devices are commonly deployed in residential and commercial security systems, unauthorized access could have significant implications for physical security.

Critical Impact

Attackers could gain unauthorized access to security panel settings, potentially disabling alarms, modifying system configurations, or compromising the integrity of building security infrastructure.

Affected Products

• Johnson Controls Qolsys IQ Panel 4 Firmware (versions prior to 4.4.2)
• Johnson Controls Qolsys IQ Panel 4 Hardware
• Johnson Controls Qolsys IQ4 Hub Firmware (versions prior to 4.4.2)
• Johnson Controls Qolsys IQ4 Hub Hardware

Discovery Timeline

• 2024-02-08 - CVE-2024-0242 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0242

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the affected devices may inadvertently expose sensitive configuration data or settings to unauthorized users. The vulnerability exists in the panel software's access control mechanisms, which under certain conditions fail to properly validate user authorization before granting access to protected settings.

The network-based attack vector means that an attacker with network access to the vulnerable devices could potentially exploit this vulnerability without requiring any prior authentication or user interaction. This makes the vulnerability particularly dangerous in environments where these security panels are accessible over local networks or improperly exposed to the internet.

Root Cause

The root cause of CVE-2024-0242 lies in improper access control implementation within the IQ Panel4 and IQ4 Hub firmware. The software fails to adequately verify user authorization under certain circumstances before allowing access to device settings. This represents a fundamental flaw in the authentication and authorization logic of the affected firmware versions.

Attack Vector

The vulnerability is exploitable over the network. An attacker who can communicate with the affected device over the network could potentially bypass authentication controls and gain unauthorized access to system settings. The attack requires no privileges, no user interaction, and presents low attack complexity, making it accessible to a wide range of threat actors.

The exploitation scenario involves an attacker establishing network connectivity to a vulnerable IQ Panel4 or IQ4 Hub device and then leveraging the access control weakness to manipulate device settings without proper authorization. This could include modifying alarm configurations, disabling security features, or extracting sensitive information stored on the device.

Detection Methods for CVE-2024-0242

Indicators of Compromise

• Unexpected configuration changes on IQ Panel4 or IQ4 Hub devices
• Unauthorized network connections to security panel management interfaces
• Log entries indicating access to settings without corresponding legitimate user activity
• Anomalous network traffic patterns to/from security panel devices

Detection Strategies

• Monitor network traffic to IQ Panel4 and IQ4 Hub devices for unauthorized access attempts
• Implement network segmentation to isolate security panels and enable focused monitoring
• Review device logs regularly for unauthorized settings access or configuration changes
• Deploy intrusion detection systems (IDS) with rules targeting IoT device anomalies

Monitoring Recommendations

• Establish baseline network behavior for all IoT security devices and alert on deviations
• Configure SIEM solutions to correlate events from security panels with other network activity
• Implement regular firmware version audits to ensure devices are running patched versions
• Monitor for new CISA ICS advisories related to Johnson Controls products

How to Mitigate CVE-2024-0242

Immediate Actions Required

• Upgrade all affected IQ Panel4 and IQ4 Hub devices to firmware version 4.4.2 or later immediately
• Isolate vulnerable devices on a separate network segment until patching is complete
• Review device configurations for any unauthorized changes that may have occurred
• Implement network access controls to restrict who can communicate with security panel devices

Patch Information

Johnson Controls has released firmware version 4.4.2 which addresses this vulnerability. Organizations should update their IQ Panel4 and IQ4 Hub devices to this version or later. For detailed patching instructions and additional security guidance, refer to the CISA Industrial Control Systems Advisory and the Johnson Controls Security Advisory portal.

Workarounds

• Implement strict network segmentation to isolate security panels from untrusted networks
• Use firewall rules to restrict network access to security panel devices to only authorized management systems
• Disable remote network access to the panels if not operationally required
• Monitor and audit all access to security panel devices until patches can be applied

Network segmentation is critical for IoT security devices. Place all IQ Panel4 and IQ4 Hub devices on a dedicated VLAN with strict access controls, limiting connectivity to only authorized management stations and monitoring systems.