CVE-2023-4486: Uncontrolled Resource Consumption in Metasys and Facility Explorer
First published: Thu Dec 07 2023(Updated: )
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Credit: productsecurity@jci.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Johnson Controls Metasys NAE55 engines | <12.0.4 | |
| Johnson Controls Metasys NAE55 engines | ||
| All of | ||
| Johnsoncontrols Sne22000 Firmware | <12.0.4 | |
| Johnsoncontrols Sne22000 | ||
| All of | ||
| Johnsoncontrols Sne11000 Firmware | <12.0.4 | |
| Johnsoncontrols Sne11000 | ||
| All of | ||
| Johnsoncontrols Sne10500 Firmware | <12.0.4 | |
| Johnsoncontrols Sne10500 | ||
| All of | ||
| Johnsoncontrols Sne110l0 Firmware | <12.0.4 | |
| Johnsoncontrols Sne110l0 | ||
| All of | ||
| Johnsoncontrols Snc25150-0 Firmware | <12.0.4 | |
| Johnsoncontrols Snc25150-0 | ||
| All of | ||
| Johnsoncontrols Snc25150-04 Firmware | <12.0.4 | |
| Johnsoncontrols Snc25150-04 | ||
| All of | ||
| Johnsoncontrols Snc16120-0 Firmware | <12.0.4 | |
| Johnsoncontrols Snc16120-0 | ||
| All of | ||
| Johnsoncontrols Snc16120-04 Firmware | <12.0.4 | |
| Johnsoncontrols Snc16120-04 | ||
| All of | ||
| Any of | ||
| Johnsoncontrols F4-snc Firmware | <11.0.6 | |
| Johnsoncontrols F4-snc Firmware | >=12.0.0<12.0.4 | |
| Johnson Controls Facility Explorer F4-SNC |
Remedy
Update Metasys NAE55, SNE, and SNC engines to version 12.0.4.
Remedy
Update Metasys NAE55, SNE, and SNC engines to version 11.0.6.
Remedy
Update Facility Explorer F4-SNC engine to version 12.0.4.
Remedy
Update Facility Explorer F4-SNC engine to version 11.0.6.
Remedy
For more information, contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-4486?
CVE-2023-4486 has been rated as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2023-4486?
To mitigate CVE-2023-4486, upgrade to versions 11.0.6 or 12.0.4 of the affected Johnson Controls firmware.
Which Johnson Controls products are affected by CVE-2023-4486?
CVE-2023-4486 affects Johnson Controls Metasys NAE55, SNE, SNC engines, and Facility Explorer F4-SNC engines prior to specified firmware versions.
What type of attack does CVE-2023-4486 facilitate?
CVE-2023-4486 allows denial of service attacks by sending invalid authentication credentials to the login endpoint.
Is there a workaround for CVE-2023-4486 if I cannot upgrade?
Temporary workarounds for CVE-2023-4486 may include disabling remote access or implementing network segmentation.
- agent/references
- agent/type
- agent/event
- agent/weakness
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/description
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/johnsoncontrols
- canonical/johnson controls metasys nae55 engines
- canonical/johnsoncontrols sne22000 firmware
- canonical/johnsoncontrols sne22000
- canonical/johnsoncontrols sne11000 firmware
- canonical/johnsoncontrols sne11000
- canonical/johnsoncontrols sne10500 firmware
- canonical/johnsoncontrols sne10500
- canonical/johnsoncontrols sne110l0 firmware
- canonical/johnsoncontrols sne110l0
- canonical/johnsoncontrols snc25150-0 firmware
- canonical/johnsoncontrols snc25150-0
- canonical/johnsoncontrols snc25150-04 firmware
- canonical/johnsoncontrols snc25150-04
- canonical/johnsoncontrols snc16120-0 firmware
- canonical/johnsoncontrols snc16120-0
- canonical/johnsoncontrols snc16120-04 firmware
- canonical/johnsoncontrols snc16120-04
- canonical/johnsoncontrols f4-snc firmware
- version/johnsoncontrols f4-snc firmware/12.0.0
- canonical/johnson controls facility explorer f4-snc