PT-2021-17589 · Unknown · Facility Explorer Snc Series Supervisory Controller

Published 2021-07-01 · Updated 2021-07-07 · CVE-2021-27661

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Facility Explorer SNC Series Supervisory Controller (F4-SNC) (affected versions not specified)

Description The issue allows an authenticated user to gain unintended access to the controller's file system, enabling them to access or modify system files. This can be achieved by sending specifically crafted web messages to the F4-SNC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2021-27661

Affected Products

Facility Explorer Snc Series Supervisory Controller

References · 5

• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27661 · Security Note
• https://t.me/cvenotify/16967 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-182-01 · Note