Unscored severity · published Mar 29, 2015
CVE-2014-5428
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metsys · Johnsoncontrols
4.1; 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5428
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02
More from Metsys
–
CVE-2014-5427
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network…