CVE-2020-9044

CVSS V2 Medium 6.4 CVSS V3 Critical 9.1
Description
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
Overview
  • CVE ID
  • CVE-2020-9044
  • Assigner
  • productsecurity@jci.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2020-03-10T20:15:22
  • Last Modified Date
  • 2020-03-11T21:28:30
Weakness Enumerations
CWE URL
CWE-611 http://cwe.mitre.org/data/definitions/611.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:johnsoncontrols:metasys_application_and_data_server:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:a:johnsoncontrols:metasys_application_and_data_server:*:*:*:*:lite:*:*:* 1 OR 10.1
cpe:2.3:a:johnsoncontrols:metasys_extended_application_and_data_server:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:a:johnsoncontrols:metasys_lonworks_control_server:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:a:johnsoncontrols:metasys_open_application_server:10.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:johnsoncontrols:metasys_open_data_server:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:* 1 OR 13.2
AND
cpe:2.3:o:johnsoncontrols:nae55_firmware:9.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nae55_firmware:9.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nae55_firmware:9.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nae55_firmware:9.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nae55_firmware:9.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:nae55:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:nie55_firmware:9.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie55_firmware:9.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie55_firmware:9.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie55_firmware:9.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie55_firmware:9.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:nie55:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:nie59_firmware:9.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie59_firmware:9.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie59_firmware:9.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie59_firmware:9.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:johnsoncontrols:nie59_firmware:9.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:nie59:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:nae85_firmware:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:h:johnsoncontrols:nae85:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:nie85_firmware:*:*:*:*:*:*:*:* 1 OR 10.1
cpe:2.3:h:johnsoncontrols:nie85:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:nae55_firmware:8.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:nae55:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:ul_864_uukl_firmware:8.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:ul_864_uukl:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:johnsoncontrols:ord-c100-13_uuklc_firmware:8.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:johnsoncontrols:ord-c100-13_uuklc:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 6.4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 10
  • Impact Score
  • 4.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 9.1
  • Base Severity
  • CRITICAL
  • Exploitability Score
  • 3.9
  • Impact Score
  • 5.2
References
Reference URL Reference Tags
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-070-05 Third Party Advisory US Government Resource
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-9044
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9044
History
Created Old Value New Value Data Type Notes
2022-05-10 16:47:54 Added to TrackCVE
2022-12-04 12:22:01 2020-03-10T20:15Z 2020-03-10T20:15:22 CVE Published Date updated
2022-12-04 12:22:01 2020-03-11T21:28:30 CVE Modified Date updated
2022-12-04 12:22:01 Analyzed Vulnerability Status updated