Johnson Controls Metasys

Summary

Vulnerabilities 1

• High 8.8
  CVE-2021-36207

  Metasys privilege management

  Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.

  Johnson Controls Metasys ADS/ADX/OAS server
  Apr 29, 2022

Revision history

1. 2022-04-28 #1

   ICSA-22-118-01 Johnson Controls Metasys

References

• ICS Advisory ICSA-22-118-01 Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-22-118-01
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B