// For flags

CVE-2021-22272

ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.

Severity Score

9.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch

La vulnerabilidad se origina en el proceso de puesta en marcha, donde un atacante del ControlTouch puede introducir un número de serie de una manera específica para transferir el dispositivo virtualmente a su perfil my.busch-jaeger.de o mybuildings.abb.com. Un atacante con éxito puede observar y controlar un ControlTouch de forma remota en circunstancias muy específicas. El problema es corregido en la parte de la nube del sistema. No es necesario actualizar el firmware de los productos del cliente. Si un usuario quiere saber si está afectado, por favor, lea el aviso. Este problema afecta a: ABB y Busch-Jaeger, ControlTouch

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-05 CVE Reserved
  • 2021-09-27 CVE Published
  • 2024-03-15 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Abb
Search vendor "Abb"
 Mybuildings
Search vendor "Abb" for product "Mybuildings"
 < 2021-05-03
Search vendor "Abb" for product "Mybuildings" and version " < 2021-05-03"
-
Affected
Busch-jaeger
Search vendor "Busch-jaeger"
 Mybusch-jaeger
Search vendor "Busch-jaeger" for product "Mybusch-jaeger"
 < 2021-05-03
Search vendor "Busch-jaeger" for product "Mybusch-jaeger" and version " < 2021-05-03"
-
Affected