CVE-2021-36201: Johnsoncontrols C-Cure 9000 Firmware

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.

Affected products

• Johnsoncontrols C-Cure 9000 Firmware: up to and including 2.90

Published 2022-10-11. Last modified 2026-06-17.