CVE-2021-36205 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
jci	CNA	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 50%

Vendor	Product	Version
johnsoncontrols	metasys_application_and_data_server	10.0 ≤ 𝑥 < 10.1.5
johnsoncontrols	metasys_application_and_data_server	11.0 ≤ 𝑥 < 11.0.2
johnsoncontrols	metasys_extended_application_and_data_server	10.0 ≤ 𝑥 < 10.1.5
johnsoncontrols	metasys_extended_application_and_data_server	11.0 ≤ 𝑥 < 11.0.2
johnsoncontrols	metasys_open_application_server	10.0 ≤ 𝑥 < 10.1.5
johnsoncontrols	metasys_open_application_server	11.0 ≤ 𝑥 < 11.0.2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-459 - Incomplete Cleanup
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02

https://www.johnsoncontrols.com/cyber-solutions/security-advisories