Johnson Controls Metasys
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-27657US | high8.8 | — | ||
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify sy… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationMetasys
Johnson Controls recommends that users of versions earlier than 9.0 upgrade to a supported release. Users of Version 9.0 (engine), 10.0, 10.1, or 11.0 are recommended to install the patch.
- BehobenMetasys
Delete any user accounts if the user is no longer with the company or have been reassigned to another position where they no longer need to use Metasys.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan