Johnson Controls Metasys
view advisory published 2019-08-15
Successful exploitation of these vulnerabilities could be leveraged by an attacker to decrypt captured network traffic.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-7594US | critical9.1OT elevated | — | ||
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP). | ||||
| CVE-2019-7593US | critical9.1OT elevated | — | ||
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- MitigationMetasys system
Users should upgrade to Version 9.0 or later and configure sites with trusted certificates.
- MitigationMetasys system
Users should upgrade to Version 9.0 or later and configure sites with trusted certificates.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan