Unscored severity · published Mar 29, 2015
CVE-2014-5427
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read password hashes via a POST request.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metsys · Johnsoncontrols
4.1; 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5427
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02
More from Metsys
–
CVE-2014-5428
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application…