Vulnerability · Published Dec 6, 2021 · Assigned by jci
CVE-2021-36198Entrapass
High 8.3
In plain English
A high-severity information exposure in Entrapass from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)1.1%top 33.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | Entrapass | all versions prior to 8.40 – before 8.40 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories x_refsource_CONFIRM
- ICS-CERT Advisory third-party-advisory, x_refsource_CERT