What’s Vulnerable › Vulnerabilities

CVE-2021-22272: ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.

• Severity: critical (CVSS 9.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-27 · updated 2026-06-17
• Weakness: CWE-200

Description

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch

Affected products

• ABB Mybuildings: before 2021-05-03 — fixed in 2021-05-03
• Busch-Jaeger Mybusch-Jaeger: before 2021-05-03 — fixed in 2021-05-03

How to fix

Upgrade to a fixed version: ABB Mybuildings 2021-05-03; Busch-Jaeger Mybusch-Jaeger 2021-05-03. Check the vendor advisory for mitigations.

References

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&LanguageCode=en&DocumentPartId=&Action=Launch

Get alerted when CVE-2021-22272 or the next vulnerability affects your stack