ICSA-26-225-14

icsaUScisa_csaf_ot

Johnson Controls Metasys

Advisory ansehen veröffentlicht 2026-08-13

Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2026-34491US——
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (8)

  • MitigationMetasys 12

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 13

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 14

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 15

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • BehobenMetasys 12

    Metasys 12: End of support, update to later version

  • BehobenMetasys 13

    Metasys 13: End of support, update to later version

  • BehobenMetasys 14

    Metasys 14.1.5: Forecast release 2026-07-15

  • BehobenMetasys 15

    Metasys 15.0: Patch released 2026-03-25

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan