CVEvulnerability

CVE-2023-4486

7.5 HIGH Published 2023-12-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770

Description

Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.

Affected configurations

• johnsoncontrols nae55 firmware (< 12.0.4) • johnsoncontrols sne22000 firmware (< 12.0.4) • johnsoncontrols sne11000 firmware (< 12.0.4) • johnsoncontrols sne10500 firmware (< 12.0.4) • johnsoncontrols sne110l0 firmware (< 12.0.4) • johnsoncontrols snc25150-0 firmware (< 12.0.4) • johnsoncontrols snc25150-04 firmware (< 12.0.4) • johnsoncontrols snc16120-0 firmware (< 12.0.4) • johnsoncontrols snc16120-04 firmware (< 12.0.4) • johnsoncontrols f4-snc firmware (< 11.0.6) • johnsoncontrols f4-snc firmware (>= 12.0.0 < 12.0.4)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References