High ICSA-20-070-05 1 CVE

Johnson Controls Metasys

Published Mar 10, 2020 · Updated Mar 10, 2020

Vendor: Johnson Controls Product: Application and Data Server (ADS ADS-Lite) Product: Extended Application and Data Server (ADX) Product: LonWorks Control Server (LCS) Product: NAE85 and NIE85 Product: Network Automation Engine (NAE55 only) Product: Network Integration Engine (NIE55/NIE59) Product: Open Application Server (OAS) Product: Open Data Server (ODS) Product: Smoke Control Network Automation Engine (NAE55 UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) Product: System Configuration Tool (SCT)

Summary

Successful exploitation of this vulnerability can allow a denial-of-service attack or disclosure of sensitive data.

Vulnerabilities 1

High 7.5

CVE-2020-9044

Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and …

Johnson Controls Metasys NAE85 and NIE85 Metasys System Configuration Tool (SCT) Metasys Extended Application and Data Server (ADX)

Mar 10, 2020

Revision history

2020-03-10 #1
ICSA-20-070-05 Johnson Controls Metasys

References

ICS Advisory ICSA-20-070-05 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-070-05
Recommended Practices
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B