CVE-2021-36204

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.42%

Published

Jan 13, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-522CWE-522

Affected Products (6)

johnsoncontrols · metasys_application_and_data_server (up to 10.1.6)vulnerable

johnsoncontrols · metasys_application_and_data_server (up to 11.0.3)vulnerable

johnsoncontrols · metasys_extended_application_and_data_server (up to 10.1.6)vulnerable

johnsoncontrols · metasys_extended_application_and_data_server (up to 11.0.3)vulnerable

johnsoncontrols · metasys_open_application_server (up to 10.1.6)vulnerable

johnsoncontrols · metasys_open_application_server (up to 11.0.3)vulnerable

References (4)

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06

Third Party AdvisoryUS Government Resource

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Vendor Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06

Third Party AdvisoryUS Government Resource

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs