title: Uncontrolled Resource Consumption in Metasys and Facility Explorer
description: Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
product: Metasys NAE55/SNE/SNC
vendor: Johnson Controls
versions:
lessThan: 12.0.4, status: affected, version: 12.0, versionType: custom
lessThan: 11.0.6, status: affected, version: 11.0, versionType: custom
}
{
defaultStatus: unaffected
product: Facility Explorer F4-SNC
vendor: Johnson Controls
versions:
lessThan: 12.0.4, status: affected, version: 12.0, versionType: custom
lessThan: 11.0.6, status: affected, version: 11.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Metasys NAE55, SNE, and SNC engines to version 12.0.4.