ICSA-21-334-04 · Published 2021-11-30 · View on CISA ICS-CERT ↗

Johnson Controls CEM Systems AC2000

CVSS 7.8 HIGH CISA KEV — Known Exploited

Risk Summary

Successful exploitation of this vulnerability could allow a local attacker to obtain super user access on the underlying Linux operating system.

CVE-2021-3156

Johnson Controls recommends users with AC2000 versions prior to 10.6 simply remove sudo. To do this, users may either contact a CEM support team or login to their Linux servers as root and type the following command: rpm -e sudo.
Note: AC2000 v10.6 includes a fixed version of sudo.
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2021-20 v1
Do not click web links or open unsolicited attachments in email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

Contolled Electronic Management Systems Ltd, Johnson Contols Inc.

Contolled Electronic Management Systems Ltd, Johnson Contols Inc. · CEM Systems AC2000 < 10.6

Critical Manufacturing

OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.