Vulnerability · Published Dec 7, 2023 · Assigned by jci
CVE-2023-4486Uncontrolled Resource Consumption in Metasys and Facility Explorer
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Facility Explorer F4-SNC from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | Metasys NAE55/SNE/SNC | 12.0 – before 12.0.411.0 – before 11.0.6 |
| Johnson Controls | Facility Explorer F4-SNC | 12.0 – before 12.0.411.0 – before 11.0.6 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H