Skip to content
OpenAdvisories
High ICSA-23-341-03 1 CVE

Johnson Controls Metasys and Facility Explorer (Update A)

Published Dec 7, 2023 · Updated Dec 19, 2023 · Revision 2

Vendor: Johnson Controls Product: Facility Explorer F4-SNC Product: Metasys NAE55 engines Product: Metasys SNC engines Product: Metasys SNE engines

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service by sending invalid credentials.

Vulnerabilities 1

  • High 7.5
    CVE-2023-4486

    Uncontrolled Resource Consumption in Metasys and Facility Explorer

    Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 1…

    Johnson Controls Facility Explorer F4-SNC Metasys NAE55/SNE/SNC

Revision history

  1. #2

    Update A - Update to the mitigations and affected products

  2. #1

    Initial Publication

References