CVE-2025-26385 Metasys product command injection vulnerability could allow remote SQL execution

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Application and Data Server (ADS)",
      "Extended Application and Data Server",
      "LCS8500 or NAE8500  (ADX)",
      "Controller Configuration Tool (CCT)",
      "System Configuration Tool (SCT)"
    ],
    "product": "Metasys",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior",
        "versionType": "custom"
      }
    ]
  }
]