CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-4486
High (7.5) in johnsoncontrols. EPSS 0.8% chance of exploitation in the next 30 days.
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-770, CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- johnsoncontrols:f4-snc_firmware
- johnsoncontrols:nae55_firmware
- johnsoncontrols:snc16120-04_firmware
- johnsoncontrols:snc16120-0_firmware
- johnsoncontrols:snc25150-04_firmware
- johnsoncontrols:snc25150-0_firmware
- johnsoncontrols:sne10500_firmware
- johnsoncontrols:sne11000_firmware
- johnsoncontrols:sne110l0_firmware
- johnsoncontrols:sne22000_firmware