CVE-2021-27663: CEM Systems AC2000

Q: What is the severity of CVE-2021-27663?

The severity of CVE-2021-27663 is critical with a CVSS score of 9.8.

Q: What is the description of CVE-2021-27663?

CVE-2021-27663 is a vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 that allows a remote attacker to access the system without proper authorization.

Q: Which software versions are affected by CVE-2021-27663?

Versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 are affected by CVE-2021-27663.

Q: How can I fix CVE-2021-27663?

To fix CVE-2021-27663, it is recommended to update Johnson Controls CEM Systems AC2000 to a patched version or apply the necessary security updates provided by Johnson Controls.

Q: Where can I find more information about CVE-2021-27663?

You can find more information about CVE-2021-27663 on the official security advisories from Johnson Controls and the US-CERT website.

Published Aug 30, 2021

Updated

A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.

Affected Software

2 affected components

Johnsoncontrols Ac2000 Firmware>=10.1<=10.5

Johnsoncontrols Ac2000

Remediation

Information

Apply a patch to all affected versions and implementations. The fix will also be included in 10.5 Server Feature Pack 2, version 10.6 and all future releases. To access the patch, affected users should contact their CEM support team: https://www.cemsys.com/support/technical-helpdesk/

Event History

Aug 30, 2021

CVE Published

via MITRE·04:37 PM

Data Sourced

via MITRE·04:37 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-27663?

The severity of CVE-2021-27663 is critical with a CVSS score of 9.8.

What is the description of CVE-2021-27663?