Threat Investigation
Request a demo

CVE-2023-4486

High

Description

Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.

SeverityHigh
CVSS7.5
Exploit probability—
ProductJohnsoncontrols Nae55 Firmware
PublishedDec 7, 2023
First seenDec 7, 2023
Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update
  • johnsoncontrols nae55_firmware12.0.4 or later
  • johnsoncontrols sne22000_firmware12.0.4 or later
  • johnsoncontrols sne11000_firmware12.0.4 or later
  • johnsoncontrols sne10500_firmware12.0.4 or later
  • johnsoncontrols sne110l0_firmware12.0.4 or later
  • johnsoncontrols snc25150-0_firmware12.0.4 or later
  • johnsoncontrols snc25150-04_firmware12.0.4 or later
  • johnsoncontrols snc16120-0_firmware12.0.4 or later
  • johnsoncontrols snc16120-04_firmware12.0.4 or later
  • johnsoncontrols f4-snc_firmware11.0.6, 12.0.4 or later

Affected products

ProductAffected versionsFixed in
johnsoncontrols nae55_firmwarev < 12.0.412.0.4
johnsoncontrols sne22000_firmwarev < 12.0.412.0.4
johnsoncontrols sne11000_firmwarev < 12.0.412.0.4
johnsoncontrols sne10500_firmwarev < 12.0.412.0.4
johnsoncontrols sne110l0_firmwarev < 12.0.412.0.4
johnsoncontrols snc25150-0_firmwarev < 12.0.412.0.4
johnsoncontrols snc25150-04_firmwarev < 12.0.412.0.4
johnsoncontrols snc16120-0_firmwarev < 12.0.412.0.4
johnsoncontrols snc16120-04_firmwarev < 12.0.412.0.4
johnsoncontrols f4-snc_firmwarev < 11.0.6, 12.0.0 ≤ v < 12.0.411.0.6, 12.0.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.