Johnsoncontrols NAE55 Firmware vulnerabilities

2 CVEs affecting Johnsoncontrols NAE55 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4486, published 2023-12-07.

More from Johnsoncontrols.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-9044, published 2020-03-10. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys…
• CVE-2023-4486, published 2023-12-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and…