PT-2026-5389

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys versions 12.0 through 14.1 Johnson Controls Metasys Application and Data Server ADS versions 14.1 and prior Johnson Controls Metasys Extended Application and Data Server ADX version 14.1 Johnson Controls Metasys System...

CVE-2022-23683

Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete...

Command injection

Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete...

CVE-2022-23683

Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete...

CVE-2022-23683

CVE-2022-23683 describes authenticated command‑injection vulnerabilities in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation allows executing arbitrary commands as a privileged user on the underlying OS, potentially achieving complete compromise of switches running Aru...

CVE-2021-41001

An authenticated remote code execution vulnerability exists in Aruba AOS-CX Network Analytics Engine (NAE) across Aruba CX 6200F, 6300, 6400, 8320, 8325, 8400, and CX 8360 series. Affected versions are listed as AOS-CX 10.07.xxxx (≤10.07.0050), 10.08.xxxx (≤10.08.1030), and 10.09.xxxx (≤10.09.000...

CVE-2021-41001

An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine NAE in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...

CVE-2019-7594

Metasys ADS/ADX servers and NAE/NIE/NCE engines before version 9.0 use a hardcoded RC2 key for Site Management Portal (SMP) encryption. This flaw can allow an attacker with access to the key to decrypt captured network traffic between the Metasys components and the SMP client. Affected products a...

CVE-2019-7593

Metasys ADS/ADX servers and NAE/NIE/NCE engines prior to version 9.0 use a shared RSA key pair for certain Site Management Portal (SMP) encryption, allowing an attacker with access to the key to decrypt captured traffic between the Metasys components and the SMP client. CVE-2019-7593 is authentic...

Johnson Controls MS-NAE3514-2 Metasys NAE Controller

Binary data 764906.prm...

Johnson Controls MS-NAE3520-2 Metasys NAE Controller

Binary data 764905.prm...

Johnson Controls MS-NAE4510-2 Metasys NAE Controller

Binary data 764903.prm...

Johnson Controls MS-NAE4520-2 Metasys NAE Controller

Binary data 764902.prm...

Johnson Controls MS-NAE5511-3E Metasys NAE Controller

Binary data 764900.prm...

Johnson Controls MS-NAE5521-3E Metasys NAE Controller

Binary data 764897.prm...

Johnson Controls MS-NAE3524-2 Metasys NAE Controller

Binary data 764904.prm...

Johnson Controls MS-NAE5520-3E Metasys NAE Controller

Binary data 764899.prm...

CVE-2019-1688 Cisco Network Assurance Engine CLI Access with Default Password Vulnerability

A vulnerability in the management web interface of Cisco Network Assurance Engine NAE could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service DoS condition on the server. The vulnerability is due to a fault in the password management system of NAE. ...

CVE-2019-1688

CVE-2019-1688 affects Cisco Network Assurance Engine (NAE) Release 3.0(1). The issue is a fault in the password management system that can let an unauthenticated, local attacker gain unauthorized access or cause a DoS by authenticating with the default administrator password via the CLI. Impact i...