CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
61.7%
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls’ Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(500435);
script_version("1.8");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");
script_cve_id("CVE-2020-9044");
script_xref(name:"ICSA", value:"20-070-05");
script_xref(name:"CERT", value:"ICS-CERT Advisory");
script_name(english:"Johnson Controls Metasys Improper Restriction of XML External Entity Reference (CVE-2020-9044)");
script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
script_set_attribute(attribute:"description", value:
"XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks
or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite)
versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data
Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation
Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59)
versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control
Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke
Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
This plugin
only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
script_set_attribute(attribute:"see_also", value:"https://www.johnsoncontrols.com/cyber-solutions/security-advisories");
script_set_attribute(attribute:"see_also", value:"https://www.us-cert.gov/ics/advisories/icsa-20-070-05");
script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.
Users should contact a branch office for remediation. For more detailed mitigation instructions, please see Johnson
Controls Product Security Advisory JCI-PSA-2020-3 v1
For questions concerning this product, contact Johnson Controls Global Product Security; email: [email protected]");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-9044");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(611);
script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/10");
script_set_attribute(attribute:"patch_publication_date", value:"2020/03/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.1");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.2");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.3");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.1");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.2");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.3");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.1");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.2");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.3");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae85_firmware");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie85_firmware");
script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:8.1");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Tenable.ot");
script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tenable_ot_api_integration.nasl");
script_require_keys("Tenable.ot/JohnsonControls");
exit(0);
}
include('tenable_ot_cve_funcs.inc');
get_kb_item_or_exit('Tenable.ot/JohnsonControls');
var asset = tenable_ot::assets::get(vendor:'JohnsonControls');
var vuln_cpes = {
"cpe:/o:johnsoncontrols:nae55_firmware:9.0.1" :
{"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nae55_firmware:9.0.2" :
{"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nae55_firmware:9.0.3" :
{"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nae55_firmware:9.0.5" :
{"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nae55_firmware:9.0.6" :
{"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nie55_firmware:9.0.1" :
{"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie55_firmware:9.0.2" :
{"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie55_firmware:9.0.3" :
{"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie55_firmware:9.0.5" :
{"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie55_firmware:9.0.6" :
{"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie59_firmware:9.0.1" :
{"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie59_firmware:9.0.2" :
{"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie59_firmware:9.0.3" :
{"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie59_firmware:9.0.5" :
{"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nie59_firmware:9.0.6" :
{"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nae85_firmware" :
{"versionEndIncluding" : "10.1", "family" : "MetasysNae"},
"cpe:/o:johnsoncontrols:nie85_firmware" :
{"versionEndIncluding" : "10.1", "family" : "MetasysNie"},
"cpe:/o:johnsoncontrols:nae55_firmware:8.1" :
{"versionEndIncluding" : "8.1", "versionStartIncluding" : "8.1", "family" : "MetasysNae"}
};
tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
61.7%