CVE-2021-22272

Katalog CVE

CVSS 9.4 · Critical EPSS 0,66%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada abb mybuildings, mybusch-jaeger. Skor CVSS 3.1 9.4 (Critical) menurut NVD.

Deskripsi (NVD)

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch

Rincian

Terbit di NVD

27 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.4 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action... advisory vendor