Johnsoncontrols: >> Metasys System Security Vulnerabilities
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVSS Score
6.8
EPSS Score
0.001
Published
2019-08-20
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVSS Score
6.8
EPSS Score
0.001
Published
2019-08-20
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
CVSS Score
6.5
EPSS Score
0.001
Published
2018-08-01