Skip to content
OpenAdvisories
Medium ICSA-19-227-01 2 CVEs

Johnson Controls Metasys

Published Aug 15, 2019 · Updated Aug 15, 2019

Vendor: Johnson Controls Product: Metasys System

Summary

Successful exploitation of these vulnerabilities could be leveraged by an attacker to decrypt captured network traffic.

Vulnerabilities 2

  • Medium 6.8
    CVE-2019-7593

    Metasys use of shared RSA key pairs

    Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).

    Johnson Controls Metasys versions prior to 9.0
  • Medium 6.8
    CVE-2019-7594

    Metasys use of hardcoded RC2 key

    Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).

    Johnson Controls Metasys versions prior to 9.0

Revision history

  1. #1

    ICSA-19-227-01 Johnson Controls Metasys

References