CVE-2021-27657

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys versions prior to 11.0

Description The issue allows an authenticated Metasys user to gain unintended access to the server file system. This can be achieved by sending specifically crafted web messages to the Metasys system, potentially enabling the user to access or modify system files.

Recommendations For Johnson Controls Metasys versions prior to 11.0, update to a version newer than 11.0 to resolve the issue.