Kone develops elevator and building-access control systems, with its vulnerability footprint concentrated in the Group Controller product and its associated firmware. The observed weakness classes—including improper authentication, input-validation defects, OS command injection, and inclusion of untrusted functionality—reflect the operational-technology and remote-management demands of networked building-control infrastructure. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kone over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-15484CRITICAL An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec | Sep 7, 2018 | 9.8 | 34 | NO | NO |
CVE-2018-15485CRITICAL An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03. | Sep 7, 2018 | 9.1 | 30 | NO | NO |
CVE-2018-15486CRITICAL An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface | Sep 7, 2018 | 9.1 | 29 | NO | NO |
CVE-2018-15483HIGH An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04. | Sep 7, 2018 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kone.
Media articles that mention a CVE ID that affects a product developed by Kone — matched by CVE ID, not by vendor name.