Vulnerability · Published Nov 22, 2021 · Assigned by icscert

CVE-2021-38448Trane Symbio Improper Control of Generation of Code

High 7.5

In plain English

A high-severity code injection in Symbio from Trane. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected products (as reported)

Vendor	Product	Versions
Trane	Symbio	700 – before 1.00.0023800 – before 1.00.0007

Weakness: CWE-94 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-266-01 x_refsource_CONFIRM