{"containers": {"cna": {"affected": [{"platforms": ["virtual"], "product": "mybuildings.abb.com", "vendor": "ABB", "versions": [{"lessThan": "2021-05-03", "status": "affected", "version": "2021-05-03", "versionType": "custom"}]}, {"platforms": ["virtual"], "product": "my.busch-jaeger.de", "vendor": "Busch-Jaeger", "versions": [{"lessThan": "2021-05-03", "status": "affected", "version": "2021-05-03", "versionType": "custom"}]}], "datePublic": "2021-06-30T00:00:00", "descriptions": [{"lang": "en", "value": "The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-27T13:40:32", "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9", "shortName": "ABB"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch"}], "source": {"discovery": "UNKNOWN"}, "title": "ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@ch.abb.com", "DATE_PUBLIC": "2021-06-30T07:56:00.000Z", "ID": "CVE-2021-22272", "STATE": "PUBLIC", "TITLE": "ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "mybuildings.abb.com", "version": {"version_data": [{"platform": "virtual", "version_affected": "<", "version_name": "2021-05-03", "version_value": "2021-05-03"}]}}]}, "vendor_name": "ABB"}, {"product": {"product_data": [{"product_name": "my.busch-jaeger.de", "version": {"version_data": [{"platform": "virtual", "version_affected": "<", "version_name": "2021-05-03", "version_value": "2021-05-03"}]}}]}, "vendor_name": "Busch-Jaeger"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch", "refsource": "MISC", "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9", "assignerShortName": "ABB", "cveId": "CVE-2021-22272", "datePublished": "2021-06-30T00:00:00", "dateReserved": "2021-01-05T00:00:00", "dateUpdated": "2021-09-27T13:40:32", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:abb:mybuildings:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC832DCC-FB85-438B-A53F-7F9A45F47004", "versionEndExcluding": "2021-05-03", "vulnerable": true}, {"criteria": "cpe:2.3:a:busch-jaeger:mybusch-jaeger:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CB7238B-280E-439D-A8BA-F0FA1195BB4C", "versionEndExcluding": "2021-05-03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch"}, {"lang": "es", "value": "La vulnerabilidad se origina en el proceso de puesta en marcha, donde un atacante del ControlTouch puede introducir un n\u00famero de serie de una manera espec\u00edfica para transferir el dispositivo virtualmente a su perfil my.busch-jaeger.de o mybuildings.abb.com. Un atacante con \u00e9xito puede observar y controlar un ControlTouch de forma remota en circunstancias muy espec\u00edficas. El problema es corregido en la parte de la nube del sistema. No es necesario actualizar el firmware de los productos del cliente. Si un usuario quiere saber si est\u00e1 afectado, por favor, lea el aviso. Este problema afecta a: ABB y Busch-Jaeger, ControlTouch"}], "id": "CVE-2021-22272", "lastModified": "2021-10-08T14:16:33.820", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 9.5, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "cybersecurity@ch.abb.com", "type": "Secondary"}]}, "published": "2021-09-27T14:15:07.957", "references": [{"source": "cybersecurity@ch.abb.com", "tags": ["Vendor Advisory"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch"}], "sourceIdentifier": "cybersecurity@ch.abb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "cybersecurity@ch.abb.com", "type": "Secondary"}]}

{}