CVE-2023-4486

🗓️ 07 Dec 2023 19:55:39Reported by jciType

Invalid authentication credentials in Johnson Controls Metasys NAE55, SNE, and SNC engines prior to v12.0.4 and Facility Explorer F4-SNC engines prior to v11.0.6 and 12.0.4 lead to denial-of-servic

Reporter	Title	Published	Views	Family All 9
CNNVD	Johnson Controls Facility Explorer Security Vulnerability	7 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-4486 Uncontrolled Resource Consumption in Metasys and Facility Explorer	7 Dec 202319:55	–	cvelist
EUVD	EUVD-2023-54341	3 Oct 202520:07	–	euvd
ICS	Johnson Controls Metasys and Facility Explorer (Update A)	7 Dec 202307:00	–	ics
NVD	CVE-2023-4486	7 Dec 202320:15	–	nvd
Prion	Design/Logic Flaw	7 Dec 202320:15	–	prion
Positive Technologies	PT-2023-29311 · Johnson Controls · Metasys +1	7 Dec 202300:00	–	ptsecurity
Tenable Nessus	Johnson Controls Metasys and Facility Explorer Uncontrolled Resource Consumption (CVE-2023-4486)	14 Dec 202300:00	–	nessus
Vulnrichment	CVE-2023-4486 Uncontrolled Resource Consumption in Metasys and Facility Explorer	7 Dec 202319:55	–	vulnrichment

NVD

Node

johnsoncontrols nae55_firmwareRange<12.0.4

AND

johnsoncontrols nae55Match-

Node

johnsoncontrols sne22000_firmwareRange<12.0.4

AND

johnsoncontrols sne22000Match-

Node

johnsoncontrols sne11000_firmwareRange<12.0.4

AND

johnsoncontrols sne11000Match-

Node

johnsoncontrols sne10500_firmwareRange<12.0.4

AND

johnsoncontrols sne10500Match-

Node

johnsoncontrols sne110l0_firmwareRange<12.0.4

AND

johnsoncontrols sne110l0Match-

Node

johnsoncontrols snc25150-0_firmwareRange<12.0.4

AND

johnsoncontrols snc25150-0Match-

Node

johnsoncontrols snc25150-04_firmwareRange<12.0.4

AND

johnsoncontrols snc25150-04Match-

Node

johnsoncontrols snc16120-0_firmwareRange<12.0.4

AND

johnsoncontrols snc16120-0Match-

Node

johnsoncontrols snc16120-04_firmwareRange<12.0.4

AND

johnsoncontrols snc16120-04Match-

Node

johnsoncontrols f4-snc_firmwareRange<11.0.6

johnsoncontrols f4-snc_firmwareRange12.0.0–12.0.4

AND

johnsoncontrols f4-sncMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Metasys NAE55/SNE/SNC",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "12.0.4",
        "status": "affected",
        "version": "12.0",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.6",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Facility Explorer F4-SNC",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "12.0.4",
        "status": "affected",
        "version": "12.0",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.6",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
johnsoncontrols	www.johnsoncontrols.com/cyber-solutions/security-advisories
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-341-03

21 Nov 2024 08:35Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.00171

SSVC