Description
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Johnson Controls | Metasys ADS/ADX/OAS server | All 10 versions – < 10.1.5, All 11 versions – < 11.0.2 | 10.1.5 |
Advisories 1
- ICSA-22-125-01 Johnson Controls Metasys CISA ICS & IT advisories · May 5, 2022
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- ICS-CERT Advisory third-party-advisory