← Back

CVE-2021-38448

nvd nist
Published: Nov 22, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.6
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 6.0
Source: NVD

Description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected (3)

Trane
2 products
Symbio 700
Symbio 800
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Symbio 700
Before 1.00.0023
Running on/withPlatform Versions
Trane
Odyssey Split Systems
All versions
Configuration B
1 platform
Running on/withPlatform Versions
Trane
Intellipak 1
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Symbio 800
Before 1.30.0008
Running on/withPlatform Versions
Trane
Intellipak 2
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Symbio 800
Before 1.10.0010
Running on/withPlatform Versions
Trane
Ascend Air Cooled Chiller Acr
All versions

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

Source: ics-cert@hq.dhs.gov
MitigationThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.