ICS Advisories

Risk evaluation

A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.

Mitigation summary

The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.