CVE-2021-27661
📋 TL;DR
This vulnerability allows authenticated users of Johnson Controls Facility Explorer SNC Series Supervisory Controllers to gain unintended file system access by sending specially crafted web messages. Attackers could read or modify system files, potentially compromising controller functionality. This affects F4-SNC controllers running vulnerable firmware versions.
💻 Affected Systems
- Johnson Controls Facility Explorer SNC Series Supervisory Controller (F4-SNC)
📦 What is this software?
F4 Snc Firmware by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could modify critical system files, disrupt building automation systems, install persistent malware, or gain complete control of the supervisory controller.
Likely Case
Authenticated users could access sensitive configuration files, modify system settings, or disrupt normal controller operations.
If Mitigated
With proper network segmentation and access controls, impact would be limited to isolated building automation networks with minimal effect on critical operations.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface and knowledge of the specific web message format.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 3.5.0.1142 or later
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download firmware version 3.5.0.1142 or later from Johnson Controls support portal. 2. Backup current configuration. 3. Upload and install new firmware via web interface. 4. Reboot controller. 5. Verify firmware version.
🔧 Temporary Workarounds
Network Segmentation
allIsolate F4-SNC controllers from untrusted networks and limit access to authorized users only.
Access Control Restrictions
allImplement strict authentication controls and limit user privileges to minimum necessary.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate controllers from untrusted networks
- Apply principle of least privilege to user accounts and monitor for suspicious web message activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Login > System > About. If version is below 3.5.0.1142, system is vulnerable.Check Version:
No CLI command available. Check via web interface at System > About.Verify Fix Applied:
After patching, verify firmware version shows 3.5.0.1142 or higher in System > About page.📡 Detection & Monitoring
Log Indicators:
- Unusual web message patterns in controller logs
- Multiple failed authentication attempts followed by successful login
- File system access attempts from web interface
Network Indicators:
- Unusual HTTP POST requests to controller web interface
- Traffic patterns indicating file system enumeration
SIEM Query:
source="f4-snc-logs" AND (message="*web message*" OR message="*file access*")