Strix
26.1K

CVE-2020-9044

CRITICALCVSS 9.1/10EPSS 1.29%

Last modified

CVE-2020-9044 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.. EPSS estimates a 1.29% chance of exploitation in the next 30 days.

Description

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

Metrics

CVSS 3.1
9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Probability
1.29%

66.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
JohnsoncontrolsMetasys Application And Data Server<= 10.1
JohnsoncontrolsMetasys Extended Application And Data Server<= 10.1
JohnsoncontrolsMetasys Lonworks Control Server<= 10.1
JohnsoncontrolsMetasys Open Application Server10.1
JohnsoncontrolsMetasys Open Data Server<= 10.1
JohnsoncontrolsMetasys System Configuration Tool<= 13.2
JohnsoncontrolsNae55 Firmware9.0.1
JohnsoncontrolsNae55 Firmware9.0.2
JohnsoncontrolsNae55 Firmware9.0.3
JohnsoncontrolsNae55 Firmware9.0.5
JohnsoncontrolsNae55 Firmware9.0.6
JohnsoncontrolsNie55 Firmware9.0.1
JohnsoncontrolsNie55 Firmware9.0.2
JohnsoncontrolsNie55 Firmware9.0.3
JohnsoncontrolsNie55 Firmware9.0.5
JohnsoncontrolsNie55 Firmware9.0.6
JohnsoncontrolsNie59 Firmware9.0.1
JohnsoncontrolsNie59 Firmware9.0.2
JohnsoncontrolsNie59 Firmware9.0.3
JohnsoncontrolsNie59 Firmware9.0.5
JohnsoncontrolsNie59 Firmware9.0.6
JohnsoncontrolsNae85 Firmware<= 10.1
JohnsoncontrolsNie85 Firmware<= 10.1
JohnsoncontrolsNae55 Firmware8.1
JohnsoncontrolsUl 864 Uukl Firmware8.1
JohnsoncontrolsOrd-C100-13 Uuklc Firmware8.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-9044?
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
How severe is CVE-2020-9044?
CVE-2020-9044 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 1.29% probability of exploitation in the next 30 days.
How do I fix CVE-2020-9044?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-9044?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST