CVE-2021-36207 HIGH

CVE-2021-36207: Metasys privilege management

Vendor Johnson Controls
Product Metasys ADS/ADX/OAS server
Weakness CWE-269
Published April 29, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.

Key dates

02Disclosure timeline

April 29, 2022 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-8306 CVE-2024-33569 WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability CVE-2021-23891 Privilege Escalation vulnerability in McAfee Total Protection (MTP) CVE-2024-3388 PAN-OS: User Impersonation in GlobalProtect SSL VPN CVE-2025-0505 On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state