Critical severity · published Mar 10, 2020
CVE-2020-9044
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files
9.1
CVSS
1.3%
EPSS
No
On KEV
Description
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Metasys Application And Data Server · Johnsoncontrols
through 10.1; through 10.1 · source: NVD
ME
Metasys Extended Application And Data Server · Johnsoncontrols
through 10.1 · source: NVD
ML
Metasys Lonworks Control Server · Johnsoncontrols
through 10.1 · source: NVD
MO
Metasys Open Application Server · Johnsoncontrols
10.1 · source: NVD
MO
Metasys Open Data Server · Johnsoncontrols
through 10.1 · source: NVD
MS
Metasys System Configuration Tool · Johnsoncontrols
through 13.2 · source: NVD
NF
Nae55 Firmware · Johnsoncontrols
9.0.1; 9.0.2; 9.0.3; 9.0.5; 9.0.6; 8.1 · source: NVD
NF
Nae85 Firmware · Johnsoncontrols
through 10.1 · source: NVD
NF
Nie55 Firmware · Johnsoncontrols
9.0.1; 9.0.2; 9.0.3; 9.0.5; 9.0.6 · source: NVD
NF
Nie59 Firmware · Johnsoncontrols
9.0.1; 9.0.2; 9.0.3; 9.0.5; 9.0.6 · source: NVD
NF
Nie85 Firmware · Johnsoncontrols
through 10.1 · source: NVD
OU
Ord-c100-13 Uuklc Firmware · Johnsoncontrols
8.1 · source: NVD
Affected product
MA
Metasys Application And Data Server
Johnsoncontrols
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9044
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9044
Vendor Advisory
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-070-05
More from Metasys Application And Data Server
9.8
CVE-2021-36205
Under certain circumstances the session token is not cleared on logout
8.8
CVE-2022-21934
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5…
8.8
CVE-2021-36207
Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to…
8.8
CVE-2021-36202
Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature
7.5
CVE-2021-36204
Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3…