CVE-2021-27657

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

• CWE-269
• CWE-269

• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01Third Party Advisory, US Government Resource
• https://us-cert.gov/ics/advisoriesThird Party Advisory, US Government Resource
• https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01Third Party Advisory, US Government Resource
• https://us-cert.gov/ics/advisoriesThird Party Advisory, US Government Resource
• https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

Published

Jun 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27649Use after free vulnerability in file transfer protocol compo…9.8
• CVE-2021-27650Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-27651In versions 8.2.1 through 8.5.2 of Pega Infinity, the passwo…9.8
• CVE-2021-27653Misconfiguration of the Pega Chat Access Group portal in Peg…4.9
• CVE-2021-27654Forgotten password reset functionality for local accounts ca…7.8
• CVE-2021-27656A vulnerability in exacqVision Web Service 20.12.2.0 and pri…7.5
• CVE-2021-27658exacqVision Enterprise Manager 20.12 does not sufficiently v…5.4
• CVE-2021-27659exacqVision Web Service 21.03 does not sufficiently validate…6.1
• CVE-2021-27660An insecure client auto update feature in C-CURE 9000 can al…8.8
• CVE-2021-27661Successful exploitation of this vulnerability could give an …8.8
• CVE-2021-27662The KT-1 door controller is susceptible to replay or man-in-…8.1
• CVE-2021-27663A vulnerability in versions 10.1 through 10.5 of Johnson Con…9.8