Johnson Controls Sensormatic Electronics VideoEdge
Under specific circumstances, a local authenticated user may be able to exploit this vulnerability to gain administrative access.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3156US | high7.8OT critical | KEV | ||
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line arg… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationVideoEdge
American Dynamics is a Johnson Controls brand. Users may contact American Dynamics technical support for assistance with updating their operating system. https://www.americandynamics.net/Support
https://www.americandynamics.net/Support - FixedVideoEdge
Johnson Controls recommends users upgrade to the latest VideoEdge release (currently 5.7.0). If this is not possible, a sudo patch is available from the American Dynamics website for VideoEdge 5.4.2 and 5.6.0. VideoEdge 5.4.1 and older cannot be patched and should be upgraded.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan