CVE-2023-4486

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys NAE55, SNE, and SNC engines versions prior to 11.0.6 and 12.0.4 Facility Explorer F4-SNC engines versions prior to 11.0.6 and 12.0.4

Description Under certain circumstances, invalid authentication credentials could be sent to the "login endpoint" of the affected engines to cause denial-of-service.

Recommendations For Johnson Controls Metasys NAE55, SNE, and SNC engines versions prior to 11.0.6 and 12.0.4, update to version 11.0.6 or 12.0.4 or later. For Facility Explorer F4-SNC engines versions prior to 11.0.6 and 12.0.4, update to version 11.0.6 or 12.0.4 or later. As a temporary workaround, consider restricting access to the "login endpoint" until a patch is available.