CVE-2023-4486: Uncontrolled Resource Consumption in Metasys and Facility Explorer
First published: Thu Dec 07 2023(Updated: )
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Credit: productsecurity@jci.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Johnson Controls NAE55 Firmware | <12.0.4 | |
| Johnsoncontrols Nae55 Firmware | ||
| All of | ||
| Johnson Controls Sne22000 | <12.0.4 | |
| Johnson Controls Sne22000 | ||
| All of | ||
| Johnson Controls SNE11000 | <12.0.4 | |
| Johnsoncontrols Sne11000 Firmware | ||
| All of | ||
| Johnson Controls Sne10500 | <12.0.4 | |
| Johnson Controls Sne10500 | ||
| All of | ||
| Johnson Controls SNE110L0 | <12.0.4 | |
| Johnson Controls SNE110L0 | ||
| All of | ||
| Johnson Controls SNC25150-0 | <12.0.4 | |
| Johnson Controls SNC25150-0 | ||
| All of | ||
| Johnson Controls SNC25150-04 | <12.0.4 | |
| Johnson Controls SNC25150-04 | ||
| All of | ||
| Johnson Controls SNC16120-0 | <12.0.4 | |
| Johnson Controls SNC16120-0 | ||
| All of | ||
| Johnson Controls SNC16120-04 Firmware | <12.0.4 | |
| Johnsoncontrols Snc16120-04 Firmware | ||
| All of | ||
| Any of | ||
| Johnson Controls F4-SNC Firmware | <11.0.6 | |
| Johnson Controls F4-SNC Firmware | >=12.0.0<12.0.4 | |
| Johnson Controls F4-SNC Firmware |
Remedy
Update Metasys NAE55, SNE, and SNC engines to version 12.0.4.
Remedy
Update Metasys NAE55, SNE, and SNC engines to version 11.0.6.
Remedy
Update Facility Explorer F4-SNC engine to version 12.0.4.
Remedy
Update Facility Explorer F4-SNC engine to version 11.0.6.
Remedy
For more information, contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-4486?
CVE-2023-4486 has been rated as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2023-4486?
To mitigate CVE-2023-4486, upgrade to versions 11.0.6 or 12.0.4 of the affected Johnson Controls firmware.
Which Johnson Controls products are affected by CVE-2023-4486?
CVE-2023-4486 affects Johnson Controls Metasys NAE55, SNE, SNC engines, and Facility Explorer F4-SNC engines prior to specified firmware versions.
What type of attack does CVE-2023-4486 facilitate?
CVE-2023-4486 allows denial of service attacks by sending invalid authentication credentials to the login endpoint.
Is there a workaround for CVE-2023-4486 if I cannot upgrade?
Temporary workarounds for CVE-2023-4486 may include disabling remote access or implementing network segmentation.
- agent/references
- agent/type
- agent/event
- agent/weakness
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/description
- agent/source
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- vendor/johnsoncontrols
- canonical/johnson controls nae55 firmware
- canonical/johnsoncontrols nae55 firmware
- canonical/johnson controls sne22000
- canonical/johnson controls sne11000
- canonical/johnsoncontrols sne11000 firmware
- canonical/johnson controls sne10500
- canonical/johnson controls sne110l0
- canonical/johnson controls snc25150-0
- canonical/johnson controls snc25150-04
- canonical/johnson controls snc16120-0
- canonical/johnson controls snc16120-04 firmware
- canonical/johnsoncontrols snc16120-04 firmware
- canonical/johnson controls f4-snc firmware
- version/johnson controls f4-snc firmware/12.0.0