Description
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Johnson Controls | Facility Explorer SNC Series Supervisory Controllers (F4-SNC) | Facility Explorer SNC Series Supervisory Controllers version 11 11 | — |
Advisories 1
- ICSA-21-182-01 Johnson Controls Facility Explorer CISA ICS & IT advisories · Jul 1, 2021
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- ICS-CERT Advisory third-party-advisory