PT-2022-3555 · Johnson Controls · Metasys Ads/Adx/Oas Server

Published 2022-04-29 · Updated 2022-05-11 · CVE-2021-36207

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Metasys ADS/ADX/OAS servers versions 10 and 11

Description The issue is related to improper privilege management in the servers, which could allow an authenticated user to elevate their privileges to administrator under certain circumstances. This could potentially be exploited by a remote attacker to gain administrator-level access.

Recommendations For versions 10 and 11, consider restricting access to sensitive areas of the server until a proper fix is applied, focusing on limiting the capabilities of authenticated users to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04339

CVE-2021-36207

Affected Products

Metasys Ads/Adx/Oas Server

References · 6

• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36207 · Security Note
• https://bdu.fstec.ru/vul/2022-04339 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36207 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-118-01 · Note
• https://t.me/cibsecurity/41680 · Telegram Post