Johnsoncontrols f4-Snc Firmware vulnerabilities

2 CVEs affecting Johnsoncontrols f4-Snc Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4486, published 2023-12-07.

More from Johnsoncontrols.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-4486, published 2023-12-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and…
• CVE-2021-27661, published 2021-07-01. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file…