PT-2015-3808 · Johnson Controls · Metasys

Billy Rios · Publicado 2015-03-29 · Atualizado 2015-03-30 · CVE-2014-5428

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys versions 4.1 through 6.5

Description The issue allows remote attackers to execute arbitrary code by uploading a shell script due to an unrestricted file upload vulnerability in unspecified web services.

Recommendations For versions 4.1 through 6.5, restrict access to the web services to minimize the risk of exploitation. As a temporary workaround, consider disabling the file upload functionality until a patch is available.

Correção

Identificadores relacionados

CVE-2014-5428

Produtos afetados

Metasys

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-5428 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02 · Nota