This vulnerability, identified as CWE-316, concerns the cleartext storage of sensitive information in memory within Johnson Controls Simplex Incident Manager / Autocall Fire Administrator versions prior to 2.01.05. An attacker with local access and partial privileges could potentially retrieve sensitive embedded data due to this insecure memory handling. The CVSS 4.0 vector indicates a local attack vector with high complexity and partial privileges required, no user interaction, and high impact on confidentiality and security capabilities.

The vulnerability may allow an attacker with local access and limited privileges to retrieve sensitive information stored in cleartext in memory. This could lead to unauthorized disclosure of embedded sensitive data, potentially compromising system security or confidentiality. However, the attack complexity is high, and privileges required are low, limiting the ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor vendor communications for updates. Until a patch is available, restrict local access to trusted users only and consider additional controls to protect sensitive data in memory.