Critical ICSA-21-280-01 1 CVE

Johnson Controls exacqVision Server Bundle

Published Oct 7, 2021 · Updated Oct 7, 2021

Vendor: Exacq Technologies, Johnson Controls Product: exacqVision Web Service

Summary

Successful exploitation of this vulnerability could allow an unauthenticated remote user to be given access to credentials stored in the exacqVision Server.

Vulnerabilities 1

Critical 9.8

CVE-2021-27664

exacqVision Web Service

Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.

Johnson Controls exacqVision Web Service

Oct 11, 2021

Revision history

2021-10-07 #1
ICSA-21-280-01 Johnson Controls exacqVision Server Bundle

References

ICS Advisory ICSA-21-280-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-280-01
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B