Detections
Analytics

Johnson Controls Metasys Improper Restriction of XML External Entity Reference (CVE-2020-9044)

critical Tenable OT Security Plugin ID 500435

Synopsis

The remote OT asset is affected by a vulnerability.

Description

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Users should contact a branch office for remediation. For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2020-3 v1

For questions concerning this product, contact Johnson Controls Global Product Security; email: [email protected]

See Also

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

https://www.us-cert.gov/ics/advisories/icsa-20-070-05

Plugin Details

Severity: Critical

ID: 500435

Version: 1.8

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2020-9044

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:johnsoncontrols:nie85_firmware, cpe:/o:johnsoncontrols:nae55_firmware:9.0.3, cpe:/o:johnsoncontrols:nie55_firmware:9.0.2, cpe:/o:johnsoncontrols:nie55_firmware:9.0.1, cpe:/o:johnsoncontrols:nie55_firmware:9.0.5, cpe:/o:johnsoncontrols:nie55_firmware:9.0.3, cpe:/o:johnsoncontrols:nae55_firmware:9.0.5, cpe:/o:johnsoncontrols:nie59_firmware:9.0.2, cpe:/o:johnsoncontrols:nae55_firmware:9.0.1, cpe:/o:johnsoncontrols:nie59_firmware:9.0.3, cpe:/o:johnsoncontrols:nae55_firmware:9.0.2, cpe:/o:johnsoncontrols:nae55_firmware:9.0.6, cpe:/o:johnsoncontrols:nie59_firmware:9.0.5, cpe:/o:johnsoncontrols:nae85_firmware, cpe:/o:johnsoncontrols:nie55_firmware:9.0.6, cpe:/o:johnsoncontrols:nae55_firmware:8.1, cpe:/o:johnsoncontrols:nie59_firmware:9.0.1, cpe:/o:johnsoncontrols:nie59_firmware:9.0.6

Required KB Items: Tenable.ot/JohnsonControls

Exploit Ease: No known exploits are available

Patch Publication Date: 3/10/2020

Vulnerability Publication Date: 3/10/2020

Reference Information

CVE: CVE-2020-9044

CWE: 611

CERT: ICS-CERT Advisory

ICSA: 20-070-05