Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2018-10624

Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Bcpro Metasys System
CVE-2026-34491

Cross‑Site Scripting Vulnerability in Johnson Controls Metasys 14 and 15

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Metasys 14 Metasys 15 Metasys
CVE-2025-26385

Metasys product command injection vulnerability could allow remote SQL execution

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects  * Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation,  * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation,  * LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1,  * System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior,  * Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.

CVSS 4.0 · 9.5 Critical EPSS 1.5% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys
CVE-2021-36204

Insufficiently Protected Credentials in Metasys

Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Open Application Server
CVE-2022-21939

Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys System Configuration Tool
CVE-2022-21940

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys System Configuration Tool
CVE-2022-21934

Metasys Unverified Password Change

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Open Application Server
CVE-2021-36202

Metasys UI

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Open Application Server
CVE-2021-27657

Metasys Improper Privilege Management

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys
CVE-2020-9050

Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys Reporting Engine
CVE-2020-9044

Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Lonworks Control Server and 17 more
CVE-2019-7594

Metasys use of hardcoded RC2 key

Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Metasys System