CVE-2021-38448 Trane Symbio Improper Control of Generation of Code
Attackers can inject malicious code into Trane Symbio controllers to alter software flow, potentially compromising building automation systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38448?
CVE-2021-38448 is a high-severity code injection vulnerability in Trane Symbio, published on 22 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
Weakness: CWE-94
Which versions are affected by CVE-2021-38448?
It affects 2 products.
Products include Trane Symbio 700, Trane Symbio 800.
How do I fix CVE-2021-38448?
No fix has been published for CVE-2021-38448 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-38448 being exploited?
There is no known exploitation of CVE-2021-38448 in the wild and no public exploit code.
Sources
Also known as GHSA-5mr6-hrm2-p724.