High severity · published Dec 7, 2023
CVE-2023-4486
Uncontrolled Resource Consumption in Metasys and Facility Explorer
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Facility Explorer F4-SNC · Johnson Controls
12.0 before 12.0.4; 11.0 before 11.0.6 · source: vendor
MN
Metasys NAE55/SNE/SNC · Johnson Controls
12.0 before 12.0.4; 11.0 before 11.0.6 · source: vendor
FF
F4-snc Firmware · Johnsoncontrols
before 11.0.6; 12.0.0 before 12.0.4 · source: NVD
NF
Nae55 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Snc16120-0 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Snc16120-04 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Snc25150-0 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Snc25150-04 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Sne10500 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Sne11000 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Sne110l0 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD
SF
Sne22000 Firmware · Johnsoncontrols
before 12.0.4 · source: NVD