CVE-2023-4486 Uncontrolled Resource Consumption in Metasys and Facility Explorer
Attackers can cause denial of service in Johnson Controls Metasys and Facility Explorer engines by sending invalid credentials to the login endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4486?
CVE-2023-4486 is a high-severity denial of service vulnerability in Johnson Controls Facility Explorer F4-SNC, published on 7 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Which versions are affected by CVE-2023-4486?
It affects 10 products.
Products include Johnsoncontrols F4-Snc Firmware, Johnsoncontrols Nae55 Firmware, Johnsoncontrols Snc16120-04 Firmware, Johnsoncontrols Snc16120-0 Firmware, Johnsoncontrols Snc25150-04 Firmware, Johnsoncontrols Snc25150-0 Firmware and 4 more.
How do I fix CVE-2023-4486?
No fix has been published for CVE-2023-4486 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-4486 being exploited?
There is no known exploitation of CVE-2023-4486 in the wild and no public exploit code.
Other vulnerabilities in Johnson Controls Facility Explorer F4-SNC
Sources
Also known as GHSA-88j9-xvhv-gwc6.