Resource exhaustion in Johnson Controls Facility Explorer F4-Snc
CVE-2023-4486
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Johnson Controls Facility Explorer F4-Snc — versions 12.0, 11.0
- Johnson Controls Metasys Nae55/sne/snc — versions 12.0, 11.0
- Johnsoncontrols F4-Snc
- Johnsoncontrols F4-Snc Firmware
- Johnsoncontrols Nae55
- Johnsoncontrols Nae55 Firmware
- Johnsoncontrols Snc16120-0
- Johnsoncontrols Snc16120-04
- Johnsoncontrols Snc16120-04 Firmware
- Johnsoncontrols Snc16120-0 Firmware
Weakness classification (CWE)
References
- www.johnsoncontrols.com/cyber-solutions/security-advisories (Vendor Advisory)
- www.cisa.gov/news-events/ics-advisories/icsa-23-341-03 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-4486?
- CVE-2023-4486 is a high-severity vulnerability in Johnson Controls Facility Explorer F4-Snc, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2023-12-07.
- How severe is CVE-2023-4486?
- High severity. CVSS v3 base score is 7.5 out of 10.