PT-2021-17586 · Unknown · Exacqvision Enterprise Manager

Michael Heinzl + 2 · Published 2021-06-24 · Updated 2021-09-20 · CVE-2021-27658

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions exacqVision Enterprise Manager version 20.12

Description The issue arises from insufficient validation, filtering, escaping, and/or encoding of user-controllable input before it is placed in output that is used as a web page served to other users. This could potentially lead to security issues, but specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For exacqVision Enterprise Manager version 20.12, consider implementing proper input validation, filtering, escaping, and encoding to prevent potential security issues. As a temporary workaround, restrict access to user-controllable input fields until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27658

Affected Products

Exacqvision Enterprise Manager

References · 6

• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27658 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-180-02 · Note
• https://us-cert.gov/ics/advisories · Note
• https://t.me/cvenotify/16939 · Telegram Post