PT-2022-3412 · Johnson Controls · Metasys Extended Application/Data Server+2

Published 2022-06-15 · Updated 2022-06-24 · CVE-2022-21935

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server (ADS) versions prior to 10.1.5 Metasys Extended Application and Data Server (ADX) versions prior to 10.1.5 Metasys Extended Application and Data Server (ADX) versions prior to 11.0.2 Metasys Application and Data Server (ADS) versions prior to 11.0.2 Metasys Open Application Server (OAS) (affected versions not specified)

Description The issue is related to the lack of necessary checks when removing a password. This can allow a remote attacker to execute arbitrary code by exploiting the vulnerability, potentially enabling unverified password changes.

Recommendations For Metasys ADS versions prior to 10.1.5, update to version 10.1.5 or later. For Metasys ADX versions prior to 10.1.5, update to version 10.1.5 or later. For Metasys ADS versions prior to 11.0.2, update to version 11.0.2 or later. For Metasys ADX versions prior to 11.0.2, update to version 11.0.2 or later. For Metasys OAS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

CWE-620

Related Identifiers

BDU:2022-04186

CVE-2022-21935

Affected Products

Metasys Application/Data Server

Metasys Extended Application/Data Server

Metasys Open Application Server

References · 5

• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21935 · Security Note
• https://bdu.fstec.ru/vul/2022-04186 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21935 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-165-01 · Note