Johnsoncontrols Metasys System vulnerabilities

3 CVEs affecting Johnsoncontrols Metasys System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-7594, published 2019-08-20.

More from Johnsoncontrols.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-10624, published 2018-08-01. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the…
• CVE-2019-7593, published 2019-08-20. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
• CVE-2019-7594, published 2019-08-20. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).