CVE-2014-5427: Infoleak

Published Mar 29, 2015

Updated

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read password hashes via a POST request.

Affected Software

13 affected components

Johnsoncontrols Metsys=4.1

Johnsoncontrols Metsys=6.5

Johnsoncontrols Application And Data Server

Johnsoncontrols Extended Application And Data Server

Johnsoncontrols Lonworks Control Server Lcs8520

Johnsoncontrols Network Automation Engine 5510-2

Johnsoncontrols Network Automation Engine 5510-2u

Johnsoncontrols Network Automation Engine 5511-2

Johnsoncontrols Network Automation Engine 5520-2

Johnsoncontrols Network Automation Engine 5521-2

Johnsoncontrols Network Integration Engine 5510-2

Johnsoncontrols Network Integration Engine 5511-2

Johnsoncontrols Nxe8500

Event History

Mar 29, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5427?

CVE-2014-5427 has been assigned a medium severity rating due to its ability to allow remote attackers to access sensitive data.

What systems are affected by CVE-2014-5427?

CVE-2014-5427 affects Johnson Controls Metasys versions 4.1 through 6.5, including various servers and control systems.

How does CVE-2014-5427 allow unauthorized access?

CVE-2014-5427 allows unauthorized remote attackers to read sensitive files due to improper access controls in the affected software.

How do I fix CVE-2014-5427?

To mitigate CVE-2014-5427, it is recommended to upgrade to the latest version of Johnson Controls Metasys that addresses this vulnerability.

Are there any workarounds for CVE-2014-5427?

As of now, the primary solution for CVE-2014-5427 is to apply available patches or updates provided by Johnson Controls.