PT-2021-14927 · Busch Jaeger · Controltouch

Published 2021-09-27 · Updated 2021-10-08 · CVE-2021-22272

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ControlTouch (affected versions not specified)

Description: The issue originates in the commissioning process where an attacker can enter a serial number in a specific way to transfer the device virtually into their my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-22272

Affected Products

Controltouch

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-22272 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22272 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cibsecurity/29478 · Telegram Post
• https://t.me/cvenotify/21517 · Telegram Post