CVE-2023-0954

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-489

Affected software

Vendor	Product	Versions
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.	Illustra Pro Gen 4 Dome	<= Illustra.SS016.05.09.04.0006
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.	Illustra Pro Gen 4 PTZ	<= Illustra.SS010.05.09.04.0022

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-02Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesBroken Link
https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-02Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesBroken Link

Timeline

Published: Jun 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09558.8The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection a CVE-2023-09567.5External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing CVE-2023-09579.6An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability th CVE-2023-09586.5Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand CVE-2023-09596.5Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sen CVE-2023-09609.8A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /da CVE-2023-09619.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the CVE-2023-09628.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown cod CVE-2023-09639.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processin CVE-2023-09648.1A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function CVE-2023-09657.5Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results CVE-2023-09668.8A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown