CVE-2021-36200

CVE-2021-36200 affects Johnson Controls Metasys ADS/ADX/OAS with MUI, specifically versions 10 and 11. The vulnerability is missing authentication for a critical function, allowing an unauthenticated user to access the Metasys web API and enumerate users. CVSS v3 base score is 5.3 (AV:N/AC:L/PR:N...

CVE-2021-36202

CVE-2021-36202 describes a Server-Side Request Forgery (SSRF) in Johnson Controls Metasys’ MUI PDF export feature. An authenticated attacker could inject malicious code via this export path. Affected products are Metasys ADS/ADX/OAS versions prior to 10.1.5 and versions prior to 11.0.2. Mitigatio...

CVE-2021-36207

CVE-2021-36207 affects Johnson Controls Metasys ADS/ADX/OAS Servers versions 10 and 11, where improper privilege management could allow an authenticated user to elevate to administrator. Technical details across sources confirm the vulnerability lies in privilege handling for these servers, with ...

CVE-2022-21935

CVE-2022-21935 affects Johnson Controls Metasys ADS/ADX/OAS Servers version 10 prior to 10.1.5 and version 11 prior to 11.0.2, with an unverified password change vulnerability (CWE-620). The NVD/NIST entry assigns CVSSv3.1 base score 7.5 (HIGH) and CVSSv2 base 7.5, both indicating high impact on ...

CVE-2021-36205

Johnson Controls Metasys ADS/ADX/OAS Servers are affected by CVE-2021-36205 (CWE-459: Incomplete Cleanup). Under certain conditions, session tokens are not cleared on logout, enabling potential misuse of active sessions. Affected products include all Metasys ADS/ADX/OAS Servers (versions 10 and 1...

CVE-2022-21934

Vulnerability CVE-2022-21934 affects Johnson Controls Metasys ADS/ADX/OAS Servers (Versions 10 before 10.1.5 and 11 before 11.0.2). Root cause: unverified password change enabling an authenticated user to lock other users out or take over accounts. Impacts include high-severity risk to confidenti...

CVE-2022-21937

CVE-2022-21937 affects Johnson Controls Metasys ADS/ADX/OAS Servers (versions 10 prior to 10.1.5 and 11 prior to 11.0.2). The issue is an improper neutralization of input during web page generation (cross-site scripting), enabling injection and storage of malicious code into the web interface. Th...

CVE-2022-21938

CVE-2022-21938 concerns cross-site scripting in Johnson Controls Metasys ADS/ADX/OAS Servers (MUI Graphics web interface). Affected: Metasys ADS/ADX/OAS 10.x before 10.1.5 and 11.x before 11.0.2, due to improper neutralization of input during web page generation (MUI Graphics). Impact per sources...

CVE-2020-9044

CVE-2020-9044 - XML External Entity (XXE) in Metasys Web Services : The vulnerability is an XXE in Johnson Controls Metasys Web Services, enabling potential DoS and harvesting of server ASCII files. Affected products include ADS/ADS-Lite, ADX, ODS, OAS, NAE55/NIE55/ NIE59 families, NAE85/NIE85, L...

CVE-2021-36204

The CVE-2021-36204 vulnerability affects Johnson Controls Metasys ADS/ADX/OAS Servers: versions 10.x prior to 10.1.6 and 11.x prior to 11.0.3. Root cause is Insufficiently Protected Credentials, allowing API calls to expose plaintext credentials. Impact is high (confidentiality and total impact o...