CVE-2021-27664

published 2021-10-11

CVE-2021-27664: Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
johnson_controls	exacqvision_web_service	21.06.11.0 – 21.06.11.0	—
johnsoncontrols	exacqvision_web_service	<= 20.06.11.0	—

Detection & IOCs extracted from sources · hover to see the quote

• → Target affected product: exacqVision Web Service Version 21.06.11.0 or older is vulnerable to unauthenticated remote credential access ↗
• → Vulnerability class is Improper Privilege Management (CWE-269) allowing unauthenticated remote access to stored credentials — monitor for unauthenticated requests to exacqVision Web Service endpoints that return or expose credential data ↗
• → No known public exploits exist at time of advisory — prioritize detection of anomalous unauthenticated access patterns against exacqVision Web Service ↗

• · Vulnerability is only triggered under certain configurations — not all deployments are exposed ↗
• · CVSS v3 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network-exploitable, no-auth, no-interaction attack surface — treat any internet-exposed exacqVision Web Service as critically at risk ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269