Johnson Controls Metasys ADX Server
Successful exploitation of this vulnerability could allow an Active Directory user to execute validated actions without providing a valid password.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-21936US | medium6.5 | — | ||
On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-22-277-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationMetasys ADX Server
For more detailed mitigation instructions, users should see Johnson Controls Product Security Advisory JCI-PSA-2022-11 at the following location:
https://www.johnsoncontrols.com/cyber-solutions/security-advisories - BehobenMetasys ADX Server
Johnson Controls recommends users update Metasys ADX Server version 12.0 running MVE with patch 12.0.1. Users should contact Johnson Controls or Authorized Building Control Specialists (ABCS) for more information.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan