Johnson Controls Metasys SCT Pro
Priority MEDIUM 41CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Why it matters now
EPSS 0.00868 58th percentileScored 2026-11-07
Fix Fixed Metasys System Configuration Tool (SCT) (Johnnson Controls): 14.2.2Metasys System Configuration Tool Pro (SCT Pro) (Johnnson Controls): 14.2.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnnson Controls | Metasys System Configuration Tool (SCT) | All to before 14.2.2 | 14.2.2 | Patch available | CNA |
| Johnnson Controls | Metasys System Configuration Tool Pro (SCT Pro) | All to before 14.2.2 | 14.2.2 | Patch available | CNA |
- Metasys System Configuration Tool (SCT) VendorJohnnson Controls Affected All to before 14.2.2 Fixed in 14.2.2 Patch available CNA
- Metasys System Configuration Tool Pro (SCT Pro) VendorJohnnson Controls Affected All to before 14.2.2 Fixed in 14.2.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:-:*:*:* | before 14.2.2 | Vulnerable | Johnson Controls |
| cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:pro:*:*:* | before 14.2.2 | Vulnerable | Johnson Controls |
- cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:-:*:*:* Versions before 14.2.2 Vulnerable ·Johnson Controls
- cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:pro:*:*:* Versions before 14.2.2 Vulnerable ·Johnson Controls
Remediation
- Fix · CNA Metasys System Configuration Tool (SCT) (Johnnson Controls) Fixed in 14.2.2
- Fix · CNA Metasys System Configuration Tool Pro (SCT Pro) (Johnnson Controls) Fixed in 14.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36203
- 2026-10-03 Alias added: GHSA-67j2-4r5v-f48w
References
More Johnson Controls Metasys System Configuration Tool vulnerabilities
- TI-2020-07260 Metasys Improper Restriction of XML External Entity Reference CVSS 3.1CRITICAL 9.1
- TI-2022-06303 Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) CVSS 3.1HIGH 7.5
- TI-2022-06304 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) CVSS 3.1HIGH 7.5
Sources
- CVE-2021-36203 · CVE Program
- CVE-2021-36203 · NVD
- FIRST EPSS
- GHSA-67j2-4r5v-f48w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences