Kantech EntraPass: a hard-coded key in JCI access control
Johnson Controls patched a hard-coded cryptographic key in Kantech EntraPass, its door access control software. Fix in version 9.20; no known exploitation.
Who is affected
- Kantech EntraPass access control management software, all versions before 9.20
- EntraPass management workstations and servers on the internal network: security desk, back office, technical rooms
- Hotel groups and integrators running the same EntraPass build across multiple properties
How to fix
Upgrade to Kantech EntraPass 9.20, the only fix published in the JCI-PSA-2026-21 advisory dated October 26. Until then, restrict local access to EntraPass management workstations and servers: the attack vector is local, an attacker must already hold a foothold on an internal machine. Ask the integrator, in writing, for the deployed version at each property and an upgrade date. Review EntraPass console logs since October 26 to rule out abnormal use.
What happened
Johnson Controls published a security advisory on October 26, 2026, listed as JCI-PSA-2026-21 in its trust center, fixing a hard-coded cryptographic key in Kantech EntraPass, its door access control management software. The flaw, tracked as CVE-2026-71456 and rated 8.5 (CVSS v4.0) by the NVD, enables a padding oracle attack against the encrypted data the application handles. A second flaw, CVE-2026-71455 (5.3), stores sensitive information in cleartext in memory. Both are fixed in version 9.20. The NVD lists no known exploitation and neither flaw appears in the CISA KEV catalog.
The attack vector is local (AV:L in the score): exploiting the key requires access to an EntraPass workstation or server. This is not an internet-facing entry point. It is damage amplification once an attacker is already inside the network.
Why hotels should care
EntraPass typically runs staff doors, technical rooms, secured floors or suite wings, often on the same network as general IT. A key baked into the product code is identical from one installation to the next: lifted from a single deployment, it replays against every installation on the same version. Combined with a routine network compromise (phishing, ransomware), the flaw turns an already-infected management workstation into potential control over doors, well beyond a data leak.
Who is affected
- Every Kantech EntraPass installation below version 9.20, servers and operator consoles alike.
- Properties whose access control network is not segmented from general IT: the local precondition of the attack becomes trivial for an intruder already present.
- Groups and franchises: the shared key makes the attacker's work reusable across sites.
How to fix
- Upgrade every instance to EntraPass 9.20 (JCI-PSA-2026-21 advisory, October 26, 2026).
- Until then, wall off EntraPass management machines: access limited to authorized staff, no exposure to the guest network or to general-purpose workstations.
- Require the integrator or managed operator to state, in writing, the deployed version at each property and an upgrade schedule.
- If a recent internal compromise is suspected, review EntraPass console logs and treat credential reissue (cards, PINs) as a conservative measure.
Context
This is Johnson Controls' second public security advisory this month: on October 7 the Canadian centre CCCS flagged the vendor's ADVMS video surveillance product. Physical access control patches matter to hotel groups because these systems often run for a decade without an inventory, driven by management workstations open to the rest of the property's IT.