CVE-2021-36201 - Vulnerability Details - OpenCVE

Description

Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.

Published: 2022-10-11

Score: 4.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Johnson Controls

C•CURE 9000

affected

Version	Status	Constraints
`2.90 and ealier`	affected	≤ 2.90

Configuration 1 [-]

AND

cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:johnsoncontrols:c-cure_9000:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Solution

Update C•CURE 9000 2.90 with patch 2.90 SP5 or upgrade C•CURE 9000 to version 3.0. The software can be downloaded here: https://www.swhouse.com/Support/SoftwareDownloads.aspx

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2021-22822	Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00122.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03
https://www.johnsoncontrols.com/cyber-solutions/security-advisories

History

Thu, 15 May 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Johnsoncontrols C-cure 9000 C-cure 9000 Firmware

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2022-10-11T20:17:42.951Z

Updated: 2025-05-15T18:42:45.441Z

Reserved: 2021-07-06T00:00:00.000Z

Link: CVE-2021-36201

Vulnrichment

Updated: 2024-08-04T00:54:51.076Z

NVD

Status : Modified

Published: 2022-10-11T21:15:12.467

Modified: 2024-11-21T06:13:18.377

Link: CVE-2021-36201

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-36201", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "assignerShortName": "jci", "datePublished": "2022-10-11T20:17:42.951Z", "dateUpdated": "2025-05-15T18:42:45.441Z", "dateReserved": "2021-07-06T00:00:00.000Z"}, "containers": {"cna": {"title": "CCURE Observable Response Discrepancy", "datePublic": "2022-10-11T00:00:00.000Z", "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2022-10-14T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions."}], "affected": [{"vendor": "Johnson Controls", "product": "C\u2022CURE 9000", "versions": [{"version": "2.90 and ealier", "status": "affected", "lessThanOrEqual": "2.90", "versionType": "custom"}]}], "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03"}], "credits": [{"lang": "en", "value": "Kim Syversen and Mathias Kj\u00f8lleberg F\u00f8rland reported this vulnerability to Johnson Controls"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "cweId": "CWE-204"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Update C\u2022CURE 9000 2.90 with patch 2.90 SP5 or upgrade C\u2022CURE 9000 to version 3.0. The software can be downloaded here: https://www.swhouse.com/Support/SoftwareDownloads.aspx"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:54:51.076Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "tags": ["x_transferred"]}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-15T18:42:38.695115Z", "id": "CVE-2021-36201", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T18:42:45.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "tags": ["x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03", "name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:54:51.076Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-36201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-15T18:42:38.695115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T18:42:41.572Z"}}], "cna": {"title": "CCURE Observable Response Discrepancy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Kim Syversen and Mathias Kj\u00f8lleberg F\u00f8rland reported this vulnerability to Johnson Controls"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Johnson Controls", "product": "C\u2022CURE 9000", "versions": [{"status": "affected", "version": "2.90 and ealier", "versionType": "custom", "lessThanOrEqual": "2.90"}]}], "solutions": [{"lang": "en", "value": "Update C\u2022CURE 9000 2.90 with patch 2.90 SP5 or upgrade C\u2022CURE 9000 to version 3.0. The software can be downloaded here: https://www.swhouse.com/Support/SoftwareDownloads.aspx"}], "datePublic": "2022-10-11T00:00:00.000Z", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03", "name": "ICS-CERT Advisory", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2022-10-14T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-36201", "state": "PUBLISHED", "dateUpdated": "2025-05-15T18:42:45.441Z", "dateReserved": "2021-07-06T00:00:00.000Z", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "datePublished": "2022-10-11T20:17:42.951Z", "assignerShortName": "jci"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B04025F0-5B3B-41B0-A5E2-F1AE4CDD3E6C", "versionEndIncluding": "2.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:johnsoncontrols:c-cure_9000:-:*:*:*:*:*:*:*", "matchCriteriaId": "4291DD2F-EB08-4F19-98FB-C5CC8B4F3B7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions."}, {"lang": "es", "value": "Bajo ciertas circunstancias, un usuario de CCURE Portal podr\u00eda enumerar cuentas de usuario en CCURE 9000 versi\u00f3n 2.90 y versiones anteriores"}], "id": "CVE-2021-36201", "lastModified": "2024-11-21T06:13:18.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "productsecurity@jci.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-11T21:15:12.467", "references": [{"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03"}, {"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "productsecurity@jci.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}