Vulnerability · Published Jul 1, 2021 · Assigned by jci

CVE-2021-27661Facility Explorer

High 8.8

In plain English

A high-severity privilege mismanagement in Facility Explorer SNC Series Supervisory Controllers (F4-SNC) from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 42.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.

Affected products (as reported)

Vendor	Product	Versions
Johnson Controls	Facility Explorer SNC Series Supervisory Controllers (F4-SNC)	Facility Explorer SNC Series Supervisory Controllers version 11 11

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.johnsoncontrols.com/cyber-solutions/security-advisories x_refsource_CONFIRM
ICS-CERT Advisory third-party-advisory, x_refsource_CERT