CVE-2021-36200

🗓️ 22 Jul 2022 14:55:52Reported by jciType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 1402 Views

CVE-2021-36200: Unauthenticated access to Metasys web API, user enumeratio

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2021-36200	22 Jul 202218:19	–	circl
CNNVD	Johnson Controls Metasys ADS/ADX/OAS Servers 访问控制错误漏洞	21 Jul 202200:00	–	cnnvd
Cvelist	CVE-2021-36200 Metasys ADS/ADX/OAS with MUI	22 Jul 202214:55	–	cvelist
EUVD	EUVD-2021-22821	7 Oct 202500:30	–	euvd
ICS	Johnson Controls Metasys ADS, ADX, OAS	21 Jul 202200:00	–	ics
NVD	CVE-2021-36200	22 Jul 202215:15	–	nvd
OSV	CVE-2021-36200	22 Jul 202215:15	–	osv
Prion	Code injection	22 Jul 202215:15	–	prion

NVD

Node

johnsoncontrols metasys_application_and_data_serverRange10.0–10.1.6

johnsoncontrols metasys_application_and_data_serverRange11.0–11.0.2

johnsoncontrols metasys_extended_application_and_data_serverRange10.0–10.1.6

johnsoncontrols metasys_extended_application_and_data_serverRange11.0–11.0.2

johnsoncontrols metasys_open_application_serverRange10.0–10.1.6

johnsoncontrols metasys_open_application_serverRange11.0–11.0.2

[
  {
    "product": "Metasys ADS/ADX/OAS server",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "10.1.6",
        "status": "affected",
        "version": "All 10 versions",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.2",
        "status": "affected",
        "version": "All 11 versions",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
cisa	www.cisa.gov/uscert/ics/advisories/icsa-22-202-02
johnsoncontrols	www.johnsoncontrols.com/cyber-solutions/security-advisories

17 Jun 2026 03:58Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3

EPSS0.00547

CWE-306