CVE-2020-9044

mediumpriority · track · 36EPSS 0.013 · 70 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.29% (70th) EPSS
CVSS 6.4 · medium
Is it mine?
64 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationApplication and Data Server (ADS ADS-Lite)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationExtended Application and Data Server (ADX)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationLonWorks Control Server (LCS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNAE85 and NIE85cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNetwork Automation Engine (NAE55 only)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNetwork Integration Engine (NIE55/NIE59)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationOpen Application Server (OAS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationOpen Data Server (ODS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationSmoke Control Network Automation Engine (NAE55 UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationSystem Configuration Tool (SCT)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

02

cvss

Technical severity, 0–10. One row per scoring source.

9.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 4.9
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.2
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · productsecurity@jci.comexploitability 3.9 · impact 3.6
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USprimaryCWE-611US
04

affected products (64)

Products and version ranges known to be affected.

showing 20 of 64
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-20-070-05Johnson Controls Metasys2020-03-10icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability can allow a denial-of-service attack or disclosure of sensitive data.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2020-03-10modified 2026-06-17
09

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan