CVE-2021-27661 Facility Explorer
Authenticated users can escalate privileges to access or modify system files on Facility Explorer SNC controllers via crafted web messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27661?
CVE-2021-27661 is a high-severity vulnerability in Johnson Controls Facility Explorer SNC Series Supervisory Controllers (F4-SNC), published on 1 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
Which versions are affected by CVE-2021-27661?
It affects 1 product.
Products include Johnsoncontrols F4-Snc Firmware.
How do I fix CVE-2021-27661?
No fix has been published for CVE-2021-27661 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27661 being exploited?
There is no known exploitation of CVE-2021-27661 in the wild and no public exploit code.
Other vulnerabilities in Johnson Controls Facility Explorer SNC Series Supervisory Controllers (F4-SNC)
Sources
Also known as GHSA-3fjw-3ffh-wrxh.