Severity
Medium
Analysis Summary
CVE-2021-36203
Johnson Controls Metasys SCT Pro is vulnerable to server-side request forgery, caused by improper validation of user requests. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to conduct an SSRF attack, allowing the attacker to access or manipulate resources from the perspective of the affected server.
Impact
- Unauthorized Access
Indicators Of Compromise
CVE
- CVE-2021-36203
Affected Vendors
- Johnson Controls
Affected Products
- Johnson Controls Metasys SCT Pro 14.2.1
- Johnson Controls Metasys SCT 14.2.1
Remediation
Refer to Johnson Controls Product Security Advisory for patch, upgrade or suggested workaround information.