Live › vulnerability › CVE-2026-71456
Go to dashboardJohnson Controls Kantech Entrapass versions before 9.20 use a hard-coded cryptographic key. An attacker can exploit this with a padding oracle attack to decrypt or forge protected data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Organizations running Kantech Entrapass versions before 9.20 for physical access control. The sources do not describe the exact data path or configuration that makes a deployment exposed, so unknown beyond the version range.
No product ranges from the sources yet.
9.209.20 or later; the sources do not name a specific patched build beyond thisEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.
This issue affects Kantech Entrapass: before 9.20.
This page as .md · .json · in your agent: get_signal("CVE-2026-71456")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.