JciCVELIST:CVE-2023-4486CVE-2023-4486 Uncontrolled Resource Consumption in Metasys and Facility Explorer
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0005 Low
EPSS
Percentile
17.1%
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Metasys NAE55/SNE/SNC",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "12.0.4",
"status": "affected",
"version": "12.0",
"versionType": "custom"
},
{
"lessThan": "11.0.6",
"status": "affected",
"version": "11.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Facility Explorer F4-SNC",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "12.0.4",
"status": "affected",
"version": "12.0",
"versionType": "custom"
},
{
"lessThan": "11.0.6",
"status": "affected",
"version": "11.0",
"versionType": "custom"
}
]
}
]Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0005 Low
EPSS
Percentile
17.1%