Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-4486

Uncontrolled Resource Consumption in Metasys and Facility Explorer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jci

Description

Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Johnson Controls Metasys NAE55/SNE/SNC

Default version status: unaffected

  • 12.0 to < 12.0.4affected
  • 11.0 to < 11.0.6affected

Johnson Controls Facility Explorer F4-SNC

Default version status: unaffected

  • 12.0 to < 12.0.4affected
  • 11.0 to < 11.0.6affected

References