CVE-2021-27657

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Johnson Controls	Metasys	>= 11.0, <= 11.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01Third Party Advisory, US Government Resource
https://us-cert.gov/ics/advisoriesThird Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01Third Party Advisory, US Government Resource
https://us-cert.gov/ics/advisoriesThird Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

Timeline

Published: Jun 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-276585.4exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is plac CVE-2021-276596.1exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in o CVE-2021-276608.8An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.CVE-2021-276618.8Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user CVE-2021-276628.1The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This iss CVE-2021-276639.8A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system withou CVE-2021-276649.8Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.CVE-2021-276657.5An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted scrip CVE-2021-276685.3HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6 CVE-2021-276709.8Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.CVE-2021-276716.1An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: CVE-2021-276724.9SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive d