CVE-2020-90447.5HighCWE-611

CVE-2020-9044: Metasys Improper Restriction of XML External Entity Reference

Johnson Controls · Metasys Application and Data Server (ADS, ADS-Lite)

Vendor fix available · Affected: Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite) · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.3%probability of exploitation in the next 30 days

70th percentile

050100

Higher than 70% of scored CVEs

7.5HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

Affected products10

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Johnson Controls · Metasys Application and Data Server (ADS, ADS-Lite)versions 10.1 and prior
Johnson Controls · Metasys Extended Application and Data Server (ADX)versions 10.1 and prior
Johnson Controls · Metasys Open Data Server (ODS)versions 10.1 and prior
Johnson Controls · Metasys Open Application Server (OAS)version 10.1
Johnson Controls · Metasys Network Automation Engine (NAE55 only)versions 9.0.1; 9.0.2; 9.0.3; 9.0.5; 9.0.6
Johnson Controls · Metasys Network Integration Engine (NIE55/NIE59)versions 9.0.1; 9.0.2; 9.0.3; 9.0.5; 9.0.6
Johnson Controls · Metasys NAE85 and NIE85versions 10.1 and prior
Johnson Controls · Metasys LonWorks Control Server (LCS)versions 10.1 and prior
Johnson Controls · Metasys System Configuration Tool (SCT)versions 13.2 and prior
Johnson Controls · Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)version 8.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: XML External Entity · Injection and Smuggling
Vendor: Johnson Controls
Published: March 2020
Band: Possible (1 to 10%), March 2020

CoverageNo articles yet

No CyberSIXT article names CVE-2020-9044 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.