CVE-2021-27659: exacqVision Web Service CSS

Q: What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2021-27659.

Q: What is the severity level of CVE-2021-27659?

The severity level of CVE-2021-27659 is medium with a CVSS score of 6.1.

Q: What software is affected by CVE-2021-27659?

exacqVision Web Service version 21.03 is affected by CVE-2021-27659.

Q: How can I fix CVE-2021-27659?

To fix CVE-2021-27659, it is recommended to update exacqVision Web Service to a version that sufficiently validates, filters, escapes, and encodes user-controllable input.

Q: Where can I find more information about CVE-2021-27659?

More information about CVE-2021-27659 can be found in the following references: [Link 1](https://us-cert.cisa.gov/ics/advisories/icsa-21-180-01), [Link 2](https://us-cert.gov/ics/advisories), [Link 3](https://www.johnsoncontrols.com/cyber-solutions/security-advisories).

Published Jun 24, 2021

Updated

exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Software

2 affected components

Exacq Technologies, Inc., a subsidiary of Johnson Controls Inc. exacqVision Web Service: Version 21.03 and prior

Johnsoncontrols Exacqvision Web Service<=21.03

Remediation

Information

Upgrade all previous versions of exacqVision Web Service to the latest version of 21.06. Current users can obtain the critical software update from the Software Downloads location at https://www.exacq.com/support/downloads.php.

Event History

Jun 24, 2021

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-180-01

Frequently Asked Questions

What is the vulnerability ID of this security issue?