Johnson Controls Metasys ADX Server
Successful exploitation of this vulnerability could allow an Active Directory user to execute validated actions without providing a valid password.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-21936US | medium6.5 | — | ||
On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI. | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-22-277-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- MitigationMetasys ADX Server
For more detailed mitigation instructions, users should see Johnson Controls Product Security Advisory JCI-PSA-2022-11 at the following location:
https://www.johnsoncontrols.com/cyber-solutions/security-advisories - FixedMetasys ADX Server
Johnson Controls recommends users update Metasys ADX Server version 12.0 running MVE with patch 12.0.1. Users should contact Johnson Controls or Authorized Building Control Specialists (ABCS) for more information.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan