CVE-2021-36203: Johnson Controls Metasys SCT Pro
Published Apr 22, 2022
·Updated
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Affected Software
4 affected componentsFixes available
Johnson Controls, Inc. Metasys System Configuration Tool (SCT)<14.2.2
14.2.2
Johnson Controls, Inc. Metasys System Configuration Tool Pro (SCT Pro)<14.2.2
14.2.2
Johnsoncontrols Metasys System Configuration Tool<14.2.2
Johnsoncontrols Metasys System Configuration Tool<14.2.2
Remediation
Information
Johnson Controls recommends users take the following steps to mitigate this vulnerability:
Update SCT/SCT Pro with Patch 14.2.2
Take proper steps to minimize risks to all building automation systems.
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1
Event History
Apr 22, 2022
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-36203?
The severity of CVE-2021-36203 is critical with a severity value of 9.1.
2
How can an attacker exploit CVE-2021-36203?
An attacker can exploit CVE-2021-36203 by identifying and forging requests to internal systems using a specially crafted request.
3
What software is affected by CVE-2021-36203?
The Johnson Controls Metasys System Configuration Tool version up to and excluding 14.2.2 is affected by CVE-2021-36203.
4
How can I fix CVE-2021-36203?
To fix CVE-2021-36203, it is recommended to apply the necessary security patches provided by Johnson Controls.
5
Where can I find more information about CVE-2021-36203?
You can find more information about CVE-2021-36203 on the CISA website at https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02.