Description
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Johnson Controls | Metasys System | ≤ 8.0 | 9.0 |
| Johnson Controls | BCPro (BCM) | < 3.0.2 | 3.0.2 |
Advisories 2
- ICSMA-18-277-02 Change Healthcare PeerVue Web Server CISA ICS & IT advisories · Oct 4, 2018
- ICSA-18-212-02 Johnson Controls Metasys and BCPro CISA ICS & IT advisories · Jul 31, 2018