CVE-2023-4486: Uncontrolled Resource Consumption in Metasys and Facility Explorer
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Affected Software
Remediation
Information
Information
Information
Information
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4486?
CVE-2023-4486 has been rated as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2023-4486?
To mitigate CVE-2023-4486, upgrade to versions 11.0.6 or 12.0.4 of the affected Johnson Controls firmware.
Which Johnson Controls products are affected by CVE-2023-4486?
CVE-2023-4486 affects Johnson Controls Metasys NAE55, SNE, SNC engines, and Facility Explorer F4-SNC engines prior to specified firmware versions.
What type of attack does CVE-2023-4486 facilitate?
CVE-2023-4486 allows denial of service attacks by sending invalid authentication credentials to the login endpoint.
Is there a workaround for CVE-2023-4486 if I cannot upgrade?
Temporary workarounds for CVE-2023-4486 may include disabling remote access or implementing network segmentation.