CVE-2021-27657

Katalog CVE

CVSS 8.8 · High EPSS 1,2%

Kerentanan Improper Privilege Management pada johnsoncontrols metasys. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

Rincian

Terbit di NVD

4 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.johnsoncontrols.com/cyber-solutions/security-advisories advisory vendor
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01 advisory pihak ketiga · pemerintah AS
• https://us-cert.gov/ics/advisories advisory pihak ketiga · pemerintah AS