Uncontrolled Resource Consumption in Metasys and Facility Explorer

CVE-2023-4486

What is CVE-2023-4486?

A vulnerability exists in Johnson Controls' Metasys and Facility Explorer products, where invalid authentication credentials can be sent to the login endpoint. This issue may lead to denial-of-service conditions, disrupting the normal operations of affected systems. Specifically, it impacts Metasys NAE55, SNE, and SNC engines before version 12.0.4, as well as Facility Explorer F4-SNC engines before versions 11.0.6 and 12.0.4. To mitigate risks, users are advised to apply available patches and monitor for any unauthorized access attempts.

References