CVE-2021-36201 CCURE Observable Response Discrepancy
Attackers can enumerate user accounts in CCURE 9000 due to observable response discrepancies, exposing valid usernames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36201?
CVE-2021-36201 is a medium-severity vulnerability in Johnson Controls C•CURE 9000, published on 11 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.
Which versions are affected by CVE-2021-36201?
It affects 1 product.
Products include Johnsoncontrols C-Cure 9000 Firmware.
How do I fix CVE-2021-36201?
No fix has been published for CVE-2021-36201 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-36201 being exploited?
There is no known exploitation of CVE-2021-36201 in the wild and no public exploit code.
Other vulnerabilities in Johnson Controls C•CURE 9000
Sources
Also known as GHSA-r78m-94wm-v7cv.