CVE-2021-22272

CRITICAL Year: 2021
CVSS v3 Score
9.4
Critical
CVSS v2 Score
9.0
Critical
Weakness Type
CWE-200
View all →

Vulnerability Description

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch

Related Vulnerabilities

CVE-2013-6014

CRITICAL
CVSS:9.3(Critical)

Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.2 before 12.2R6, 12.3 before 12.3R3, 13...

CWE-2002013

CVE-2023-32113

CRITICAL
CVSS:9.3(Critical)

SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the aut...

CWE-2002023

CVE-2016-6658

CRITICAL
CVSS:9.6(Critical)

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a cre...

CWE-2002016

CVE-2017-14443

CRITICAL
CVSS:9.6(Critical)

An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to a...

CWE-2002017

CVE-2017-18853

CRITICAL
CVSS:9.6(Critical)

Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0.4.06 and earlier, R6400 1.0.1.20 and ear...

CWE-2002017

CVE-2023-40029

CRITICAL
CVSS:9.6(Critical)

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kube...

CWE-2002023