Lucene search

[email protected]CVE-2020-9044

HistoryMar 10, 2020 - 8:15 p.m.

CVE-2020-9044

2020-03-1020:15:22

CWE-611

[email protected]

web.nvd.nist.gov

cve-2020-9044

xxe vulnerability

johnson controls

metasys

dos attacks

file harvesting

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.8%

JSON

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls’ Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

Affected configurations

NVD

Node

johnsoncontrolsmetasys_application_and_data_serverRange≤10.1

johnsoncontrolsmetasys_application_and_data_serverRange≤10.1lite

johnsoncontrolsmetasys_extended_application_and_data_serverRange≤10.1

johnsoncontrolsmetasys_lonworks_control_serverRange≤10.1

johnsoncontrolsmetasys_open_application_serverMatch10.1

johnsoncontrolsmetasys_open_data_serverRange≤10.1

johnsoncontrolsmetasys_system_configuration_toolRange≤13.2

Node

johnsoncontrolsnae55_firmwareMatch9.0.1

johnsoncontrolsnae55_firmwareMatch9.0.2

johnsoncontrolsnae55_firmwareMatch9.0.3

johnsoncontrolsnae55_firmwareMatch9.0.5

johnsoncontrolsnae55_firmwareMatch9.0.6

AND

johnsoncontrolsnae55Match-

Node

johnsoncontrolsnie55_firmwareMatch9.0.1

johnsoncontrolsnie55_firmwareMatch9.0.2

johnsoncontrolsnie55_firmwareMatch9.0.3

johnsoncontrolsnie55_firmwareMatch9.0.5

johnsoncontrolsnie55_firmwareMatch9.0.6

AND

johnsoncontrolsnie55Match-

Node

johnsoncontrolsnie59_firmwareMatch9.0.1

johnsoncontrolsnie59_firmwareMatch9.0.2

johnsoncontrolsnie59_firmwareMatch9.0.3

johnsoncontrolsnie59_firmwareMatch9.0.5

johnsoncontrolsnie59_firmwareMatch9.0.6

AND

johnsoncontrolsnie59Match-

Node

johnsoncontrolsnae85_firmwareRange≤10.1

AND

johnsoncontrolsnae85Match-

Node

johnsoncontrolsnie85_firmwareRange≤10.1

AND

johnsoncontrolsnie85Match-

Node

johnsoncontrolsnae55_firmwareMatch8.1

AND

johnsoncontrolsnae55Match-

Node

johnsoncontrolsul_864_uukl_firmwareMatch8.1

AND

johnsoncontrolsul_864_uuklMatch-

Node

johnsoncontrolsord-c100-13_uuklc_firmwareMatch8.1

AND

johnsoncontrolsord-c100-13_uuklcMatch-

CPENameOperatorVersion
johnsoncontrols:metasys_application_and_data_serverjohnsoncontrols metasys application and data serverle10.1
johnsoncontrols:metasys_extended_application_and_data_serverjohnsoncontrols metasys extended application and data serverle10.1
johnsoncontrols:metasys_lonworks_control_serverjohnsoncontrols metasys lonworks control serverle10.1
johnsoncontrols:metasys_open_application_serverjohnsoncontrols metasys open application servereq10.1
johnsoncontrols:metasys_open_data_serverjohnsoncontrols metasys open data serverle10.1
johnsoncontrols:metasys_system_configuration_tooljohnsoncontrols metasys system configuration toolle13.2

CPE	Name	Operator	Version
johnsoncontrols:metasys_application_and_data_server	johnsoncontrols metasys application and data server	le	10.1
johnsoncontrols:metasys_extended_application_and_data_server	johnsoncontrols metasys extended application and data server	le	10.1
johnsoncontrols:metasys_lonworks_control_server	johnsoncontrols metasys lonworks control server	le	10.1
johnsoncontrols:metasys_open_application_server	johnsoncontrols metasys open application server	eq	10.1
johnsoncontrols:metasys_open_data_server	johnsoncontrols metasys open data server	le	10.1
johnsoncontrols:metasys_system_configuration_tool	johnsoncontrols metasys system configuration tool	le	13.2

CNA Affected

[
  {
    "product": "Metasys Application and Data Server (ADS, ADS-Lite)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 10.1 and prior"
      }
    ]
  },
  {
    "product": "Metasys Extended Application and Data Server (ADX)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 10.1 and prior"
      }
    ]
  },
  {
    "product": "Metasys Open Data Server (ODS)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 10.1 and prior"
      }
    ]
  },
  {
    "product": "Metasys Open Application Server (OAS)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "version 10.1"
      }
    ]
  },
  {
    "product": "Metasys Network Automation Engine (NAE55 only)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 9.0.1"
      },
      {
        "status": "affected",
        "version": "9.0.2"
      },
      {
        "status": "affected",
        "version": "9.0.3"
      },
      {
        "status": "affected",
        "version": "9.0.5"
      },
      {
        "status": "affected",
        "version": "9.0.6"
      }
    ]
  },
  {
    "product": "Metasys Network Integration Engine (NIE55/NIE59)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 9.0.1"
      },
      {
        "status": "affected",
        "version": "9.0.2"
      },
      {
        "status": "affected",
        "version": "9.0.3"
      },
      {
        "status": "affected",
        "version": "9.0.5"
      },
      {
        "status": "affected",
        "version": "9.0.6"
      }
    ]
  },
  {
    "product": "Metasys NAE85 and NIE85",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 10.1 and prior"
      }
    ]
  },
  {
    "product": "Metasys LonWorks Control Server (LCS)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 10.1 and prior"
      }
    ]
  },
  {
    "product": "Metasys System Configuration Tool (SCT)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "versions 13.2 and prior"
      }
    ]
  },
  {
    "product": "Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "version 8.1"
      }
    ]
  }
]

References

www.johnsoncontrols.com/cyber-solutions/security-advisories

www.us-cert.gov/ics/advisories/icsa-20-070-05

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.8%

JSON

Related for CVE-2020-9044

nvd1 nessus2 prion1 ics1 cvelist1