TI-2019-05361 Aliases CVE-2019-7594 GHSA-vhqp-g9vm-gc6g

Metasys use of hardcoded RC2 key

MEDIUM 40CWE-321Published 2019-08-20 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).

Why it matters now

EPSS 0.00632 50th percentileScored 2026-11-07

Fix Fixed Metasys versions prior to 9.0 (Johnson Controls): 9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Johnson Controls	Metasys versions prior to 9.0	—	9.0	Patch available	CNA

Metasys versions prior to 9.0 VendorJohnson Controls Affected — Fixed in 9.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:johnsoncontrols:metasys_system::::::::	before 9.0	Vulnerable	Johnson Controls

cpe:2.3:a:johnsoncontrols:metasys_system:*:*:*:*:*:*:*:* Versions before 9.0 Vulnerable ·Johnson Controls

Remediation

Fix · CNA Metasys versions prior to 9.0 (Johnson Controls) Fixed in 9.0

Timeline

2026-10-02 Threatist record created from CVE-2019-7594
2026-10-03 Alias added: GHSA-vhqp-g9vm-gc6g
2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 2

TI-2019-05360 Metasys use of shared RSA key pairs CVSS 3.0CRITICAL 9.1
TI-2018-07513 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences