Vulnerability · Published Oct 11, 2021 · Assigned by jci
CVE-2021-27665exacqVision Server 32-bit
High 7.5
In plain English
A high-severity integer overflow in exacqVision Web Service from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | exacqVision Web Service | 21.06.11.0 – through 21.06.11.0 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories x_refsource_CONFIRM
- ICS-CERT Advisory third-party-advisory, x_refsource_CERT