Johnson Controls Sensormatic Electronics VideoEdge
Under specific circumstances, a local authenticated user may be able to exploit this vulnerability to gain administrative access.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-3156US | high7.8OT kritisch | KEV | ||
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line arg… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationVideoEdge
American Dynamics is a Johnson Controls brand. Users may contact American Dynamics technical support for assistance with updating their operating system. https://www.americandynamics.net/Support
https://www.americandynamics.net/Support - BehobenVideoEdge
Johnson Controls recommends users upgrade to the latest VideoEdge release (currently 5.7.0). If this is not possible, a sudo patch is available from the American Dynamics website for VideoEdge 5.4.2 and 5.6.0. VideoEdge 5.4.1 and older cannot be patched and should be upgraded.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan