Unverified Password Change in Johnson Controls products - CVE-2022-21934
Published: May 6, 2022
Vulnerability identifier: #VU62832
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-21934
CWE-ID: CWE-620
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to unverified password change issue. A remote user on the local network can lock other users out of the system and take over accounts.
Affected software
Metasys ADS
Metasys ADX
Metasys Open Application Server (OAS)
Metasys ADX
Metasys Open Application Server (OAS)
How to mitigate CVE-2022-21934
Install updates from vendor's website.
Metasys ADS - addressed in versions 10.1.5, 11.0.2
Metasys ADX - addressed in versions 10.1.5, 11.0.2
Metasys Open Application Server (OAS) - addressed in versions 10.1.5, 11.0.2
Metasys ADX - addressed in versions 10.1.5, 11.0.2
Metasys Open Application Server (OAS) - addressed in versions 10.1.5, 11.0.2