CVE-2021-36198
📋 TL;DR
CVE-2021-36198 is an information disclosure vulnerability in Johnson Controls Metasys products that allows unauthorized users to access sensitive data. This affects building automation systems running vulnerable versions of Metasys software. Organizations using these systems for facility management are at risk.
💻 Affected Systems
- Johnson Controls Metasys
- Johnson Controls Facility Explorer
📦 What is this software?
Kantech Entrapass by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to building control systems, sensitive operational data, and potentially pivot to other critical infrastructure systems.
Likely Case
Unauthorized access to building automation data, operational schedules, and system configurations.
If Mitigated
Limited data exposure with proper network segmentation and access controls in place.
🎯 Exploit Status
Vulnerability allows unauthorized access without authentication, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 11.0.2 or later
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download Metasys 11.0.2 or later from Johnson Controls support portal. 2. Backup current configuration. 3. Install update following vendor documentation. 4. Restart affected services/systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Metasys systems from untrusted networks and implement strict firewall rules.
Access Control Restrictions
allImplement strict network access controls and limit connections to authorized IP addresses only.
🧯 If You Can't Patch
- Implement strict network segmentation and isolate affected systems from untrusted networks
- Deploy network monitoring and intrusion detection specifically for Metasys traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Metasys version in System Configuration or About dialog. Versions prior to 11.0.2 are vulnerable.Check Version:
Check via Metasys System Configuration interface or Windows Programs and FeaturesVerify Fix Applied:
Verify version is 11.0.2 or later and test that unauthorized access to sensitive endpoints is blocked.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Metasys endpoints
- Unusual data access patterns from unexpected sources
Network Indicators:
- Unusual traffic to Metasys ports (typically 80/443)
- Unauthorized API calls to sensitive endpoints
SIEM Query:
source_ip NOT IN (authorized_ips) AND dest_port IN (80,443) AND dest_ip IN (metasys_servers)