CVE-2021-22272
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA vulnerability in the commissioning process of ABB/Busch-Jaeger ControlTouch devices allows an attacker to enter a serial number in a specific way during device setup, transferring device ownership to the attacker's my.busch-jaeger.de or mybuildings.abb.com cloud profile. This enables remote observation and control of the hijacked device.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2021-05-03< 2021-05-03CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Log into your ABB mybuildings.abb.com cloud accountNavigate to the portal and authenticate with your credentials. Review the device list for any devices you do not recognize or did not personally add to your account.Affected if Unknown or unrecognized devices appear in your account
-
Log into your Busch-Jaeger my.busch-jaeger.de cloud accountNavigate to the portal and authenticate. Inspect all registered devices for any that you did not commission or do not own.Affected if Foreign or unrecognized devices are present in your device list
-
Review device activity logsCheck the activity/history logs within the cloud portals for any remote commands, state changes, or access events from dates you did not use the devices.Affected if Device events exist that you did not initiate
-
Check account creation dateLocate your account creation or registration date in the cloud portal settings or welcome email.Affected if Your cloud account was created before May 3, 2021 and you have not reviewed device ownership since that time
You are affected if any unrecognized devices appear in your mybuildings.abb.com or my.busch-jaeger.de accounts, indicating potential ownership transfer during the vulnerability window.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2021-05-03
The issue has been fixed on the cloud side; no firmware update is required. Users should consult the advisory to determine if they were previously affected.
- This vulnerability is fixed on the cloud side of the ABB my.busch-jaeger.de and mybuildings.abb.com systems; no customer action or firmware update is required.
- If you want to verify whether your specific ControlTouch device or account was affected, read the full security advisory at search.abb.com or contact ABB/Busch-Jaeger technical support for confirmation.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-22272 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-22272 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data