CVE-2021-36203: Johnsoncontrols Metasys System Configuration Tool

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.

Affected products

• Johnsoncontrols Metasys System Configuration Tool: before 14.2.2 (fixed in 14.2.2)

Published 2022-04-22. Last modified 2026-06-17.