Johnson Controls Metasys Products
Successful exploitation of this vulnerability could result in remote SQL execution, leading to alteration or loss of data.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26385US | — | — | ||
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of t… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-027-04 JSONself
- ICSA Advisory ICSA-26-027-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (6)
- MitigationMetasys Application and Data Server (ADS)
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
- MitigationMetasys Controller Configuration Tool (CCT)
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
- MitigationMetasys Extended Application and Data Server (ADX)
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
- MitigationMetasys LCS8500
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
- MitigationMetasys NAE8500
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
- MitigationMetasys System Configuration Tool (SCT)
Additionally, closing incoming TCP port 1433 can protect against exploitation of this vulnerability.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan