CVE-2021-27656 exacqVision Web Services - Information Exposure

What is CVE-2021-27656?

CVE-2021-27656 is a medium-severity vulnerability in Johnson Controls exacqVision Web Service version 20.12.2.0 and prior, published on 18 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.

Weakness: CWE-862

Which versions are affected by CVE-2021-27656?

It affects 1 product.

Products include Johnsoncontrols Exacqvision Web Service.

How do I fix CVE-2021-27656?

No fix has been published for CVE-2021-27656 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-27656 being exploited?

There is no known exploitation of CVE-2021-27656 in the wild and no public exploit code.

Other vulnerabilities in Johnson Controls exacqVision Web Service version 20.12.2.0 and prior

• CVE-2021-27664 exacqVision Web Service Critical 9.8
• CVE-2024-32862 exacqVision CORS Medium 6.8
• CVE-2024-32863 exacqVison - CSRF issues with Web Service Medium 6.8
• CVE-2024-32864 exacqVison - HTTPS Session Establishment Medium 6.4
• CVE-2024-32931 exacqVison - Token Disclosed in URL Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4v7v-2c44-w644.