Back to Database
Status published
High
CVE-2021-36205
Metasys session token
Vulnerability Description
Under certain circumstances the session token is not cleared on logout.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-36205
Credits & Attribution
No credits recorded in the NVD database.
References
More from Johnson Controls
View All →CVE-2025-61740
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
High
7.2
CVE-2025-61739
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
High
7.2
CVE-2025-61738
Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
Low
2.3
CVE-2025-61736
iSTAR- Improper Validation of Certificate Expiration
High
7.1
CVE-2025-43876
iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
High
8.7
Affected Vendor
Johnson Controls
View all reports →Affected Software
Metasys
Vulnerable Versions:
All 10 versions, All 11 versions
Timeline
Official Publish:
April 15th, 2022
Last Modified:
September 16th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.