Medium ICSA-22-111-02 1 CVE

Johnson Controls Metasys SCT Pro

Published Apr 21, 2022 · Updated Apr 21, 2022

Vendor: Johnson Controls Product: Metasys System Configuration Tool (SCT) Product: Metasys System Configuration Tool Pro (SCT Pro)

Summary

Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request, allowing an attacker to determine whether specific files or paths exist.

Vulnerabilities 1

Medium 5.3

CVE-2021-36203

Johnson Controls Metasys SCT Pro

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.

Johnnson Controls Metasys System Configuration Tool Pro (SCT Pro) Metasys System Configuration Tool (SCT)

Apr 22, 2022

Revision history

2022-04-21 #1
ICSA-22-111-02 Johnson Controls Metasys SCT Pro

References

ICS Advisory ICSA-22-111-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-111-02
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B