title: CEM Systems AC2000
description: A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.
problem types: CWE-285: Improper Authorization
affected:
{
product: CEM Systems AC2000
vendor: Johnson Controls
versions:
lessThanOrEqual: 10.5, status: affected, version: 10.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: Apply a patch to all affected versions and implementations.
The fix will also be included in 10.5 Server Feature Pack 2, version 10.6 and all future releases.
To access the patch, affected users should contact their CEM support team:
https://www.cemsys.com/support/technical-helpdesk/