CVE-2023-4486

Uncontrolled Resource Consumption in Metasys and Facility Explorer

State: Published
Severity: 7.5 High
Published: Dec 7, 2023
Updated: May 28, 2025
Reserved: Aug 22, 2023

Description

Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to

versions 11.0.6 and 12.0.4

and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	jci

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
Metasys NAE55/SNE/SNCJohnson Controls	12.0 to before 12.0.4Affected 11.0 to before 11.0.6Affected
Facility Explorer F4-SNCJohnson Controls	12.0 to before 12.0.4Affected 11.0 to before 11.0.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.