High ICSA-22-104-02 1 CVE

Johnson Controls Metasys

Published Apr 14, 2022 · Updated Apr 14, 2022

Vendor: Johnson Controls Product: All Metasys ADS/ADX/OAS Servers

Summary

Successful exploitation of this vulnerability could allow a remote attacker to use a session token that has not been cleared upon log out of an authenticated user.

Vulnerabilities 1

High 8.1

CVE-2021-36205

Metasys session token

Under certain circumstances the session token is not cleared on logout.

Johnson Controls Metasys

Apr 15, 2022

Revision history

2022-04-14 #1
ICSA-22-104-02 Johnson Controls Metasys

References

ICS Advisory ICSA-22-104-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B