Resource exhaustion in Johnson Controls Facility Explorer F4-Snc
CVE-2023-4486
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.008 (53.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Johnson Controls Facility Explorer F4-snc — versions 12.0, 11.0
- Johnson Controls Metasys Nae55/sne/snc — versions 12.0, 11.0
- Johnsoncontrols F4-snc
- Johnsoncontrols F4-snc_firmware
- Johnsoncontrols Nae55
- Johnsoncontrols Nae55_firmware
- Johnsoncontrols Snc16120-0
- Johnsoncontrols Snc16120-04
- Johnsoncontrols Snc16120-04_firmware
- Johnsoncontrols Snc16120-0_firmware
Weakness classification (CWE)
References
- productsecurity@jci.com (Vendor Advisory)
- productsecurity@jci.com (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-4486?
- CVE-2023-4486 is a high-severity vulnerability in Johnson Controls Facility Explorer F4-Snc, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2023-12-07.
- How severe is CVE-2023-4486?
- High severity. CVSS v3 base score is 7.5 out of 10.