Johnson Controls Kantech Entrapass: Hard-coded cryptographic key enables padding oracle attack
Summary
Johnson Controls Kantech Entrapass, access-control software, uses a hard-coded cryptographic key (CWE-321). A local attacker with a low-privileged account can exploit this to perform a padding oracle attack, which may allow compromise of confidentiality, integrity and availability on the affected system. The CNA rates the issue at CVSS 4.0 8.5 (High); NVD analysis was still pending at the time of writing.
Affected
- Kantech Entrapass before 9.20
Fixed in
- Upgrade to Kantech Entrapass 9.20 or later (per secondary sources citing Johnson Controls advisory JCI-PSA-2026-21; vendor advisory not independently verified)
Workaround
- No workaround documented by the vendor.
- Interim measure (not vendor-stated): restrict local logon to the Entrapass server and workstations until the upgrade is complete.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- No public proof of concept found; Metasploit, Exploit-DB and GitHub not checked.
Our recommendation
- Inventory all Entrapass installations and record exact versions.
- Plan the upgrade to 9.20 or later; this also covers CVE-2026-71455.
- Until then, limit local and console access to the server and reduce low-privilege accounts.
- Re-check NVD and the Johnson Controls advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Johnson Controls Product Security Advisories www.johnsoncontrols.com
- CVE record on OpenCVE app.opencve.io
- Offseq threat radar entry for CVE-2026-71456 radar.offseq.com
- Mallory report (secondary, advisory JCI-PSA-2026-21) mallory.ai
- VulDB entry for related CVE-2026-71455 vuldb.com
- CVSS vector on ThreatIntel CVE page cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:06.
Original description (NVD)
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.