Metasys Improper Privilege Management
CVE-2021-27657

8.8HIGH

Key Information:

Vendor

Johnson Controls

Status
Metasys
Vendor
CVE Published:
4 June 2021

What is CVE-2021-27657?

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

Affected Version(s)

Metasys 11.0

References

https://www.johnsoncontrols.com/cyber-solutions/security-...
x_refsource_CONFIRM
https://us-cert.gov/ics/advisories
third-party-advisoryx_refsource_CERT
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01
third-party-advisoryx_refsource_CERT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Palaczynski
.