Johnson Controls Metasys
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-27657US | high8.8 | — | ||
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify sy… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationMetasys
Johnson Controls recommends that users of versions earlier than 9.0 upgrade to a supported release. Users of Version 9.0 (engine), 10.0, 10.1, or 11.0 are recommended to install the patch.
- FixedMetasys
Delete any user accounts if the user is no longer with the company or have been reassigned to another position where they no longer need to use Metasys.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan