GCVE - cpe:2.3:a:johnsoncontrols:metasys_system:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:johnsoncontrols:metasys_system:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Johnsoncontrols (`3e1d627f-81d6-5827-bd4a-3f77847762e4`)
Product	Metasys System (`b84b20a8-f9c2-5f56-9df3-32da34d449c0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-7594`	vulnerable	2026-06-08 05:14:14.574551	Metasys use of hardcoded RC2 key MEDIUM (6.8) Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP). Published: 2019-08-20T18:24:56.000Z Updated: 2024-08-04T20:54:28.360Z Open on db.gcve.eu Reference links https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf https://www.us-cert.gov/ics/advisories/icsa-19-227-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-7593`	vulnerable	2026-06-08 05:14:14.574082	Metasys use of shared RSA key pairs MEDIUM (6.8) Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). Published: 2019-08-20T18:22:43.000Z Updated: 2024-08-04T20:54:27.934Z Open on db.gcve.eu Reference links https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf https://www.us-cert.gov/ics/advisories/icsa-19-227-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-10624`	vulnerable	2026-06-08 05:10:35.213199	Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information. Published: 2018-08-01T21:00:00.000Z Updated: 2024-09-17T00:11:43.873Z Open on db.gcve.eu Reference links https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02 http://www.securityfocus.com/bid/104937	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.