CISA Releases Twelve Industrial Control Systems Advisories

CISA released twelve Industrial Control Systems ICS advisories on January 12, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

Johnson Controls Metasys ADX Server Licensing Issue Vulnerability

Johnson Controls Metasys ADX Server is a data server from Johnson Controls, Inc. An authorization issue vulnerability exists in Johnson Controls Metasys ADX Server version 12.0, which stems from improper access controls in the application and could be exploited by an attacker to cause an AD user ...

CVE-2022-21936

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI...

Code injection

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI...

CVE-2022-21936 Metasys MVE

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI...

CVE-2022-21936

CVE-2022-21936 affects Johnson Controls Metasys ADX Server version 12.0 running MVE. The vulnerability is improper authentication, enabling an Active Directory user to execute validated actions without a valid password via the MVE SMP UI. Public impact details indicate remote exploitation with lo...

CVE-2022-21936: Improper Authentication

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI...

PT-2022-15192 · Johnson Controls · Metasys Adx Server

Name of the Vulnerable Software and Affected Versions: Metasys ADX Server version 12.0 Description: The issue allows an Active Directory user to execute validated actions without providing a valid password when using MVE SMP UI. Recommendations: For Metasys ADX Server version 12.0, consider...

CVE-2022-21936

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI...

Johnson Controls Metasys ADX 授权问题漏洞

Johnson Controls Metasys ADX Server is a data server from Johnson Controls, Inc. An authorization issue vulnerability exists in Johnson Controls Metasys ADX Server version 12.0, which stems from improper access controls in the application and could be exploited by an attacker to cause an AD user ...

Johnson Controls Metasys ADX Server

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: Metasys ADX Extended Application and Data Server Server running MVE Metasys for Validated Environments Vulnerability: Improper Authentication 2. RISK EVALUATION...

CVE-2021-36200

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

CVE-2021-36200

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

Code injection

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

CVE-2021-36200

CVE-2021-36200 affects Johnson Controls Metasys ADS/ADX/OAS with MUI, specifically versions 10 and 11. The vulnerability is missing authentication for a critical function, allowing an unauthenticated user to access the Metasys web API and enumerate users. CVSS v3 base score is 5.3 (AV:N/AC:L/PR:N...

CVE-2021-36200 Metasys ADS/ADX/OAS with MUI

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

CVE-2021-36200: Missing Authentication for Critical Function

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

PT-2022-10491

Name of the Vulnerable Software and Affected Versions Metasys ADS/ADX/OAS versions prior to 10.1.6 Metasys ADS/ADX/OAS versions prior to 11.0.2 Description Under certain circumstances, an unauthenticated user could access the web API and enumerate users. Recommendations For Metasys ADS/ADX/OAS...

CVE-2021-36200

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...

Johnson Controls Metasys ADS, ADX, OAS

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc Equipment: Metasys ADS, ADX, OAS with MUI Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...