ICSA-18-212-02

icsaUScisa_csaf_ot

Johnson Controls Metasys and BCPro

view advisory published 2018-07-31

Successful exploitation of this vulnerability could allow an attacker to obtain technical information about the Metasys or BCPro server, allowing an attacker to target a system for attack.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2018-10624USmedium6.5—
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communi…
02

references

External citations — patches, advisories, analysis.

03

remediations (2)

  • MitigationBCPro (BCM)

    This issue was remediated in Metasys v8.1 (April, 2016). Users should upgrade to the latest product version (9.0). For Metasys information, contact your Metasys field service/sales representative.

  • MitigationMetasys system

    This issue was remediated in Metasys v8.1 (April, 2016). Users should upgrade to the latest product version (9.0). For Metasys information, contact your Metasys field service/sales representative.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan