Uncontrolled Resource Consumption in Metasys and Facility Explorer
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00827 57th percentileScored 2026-11-07
Fix Fixed Metasys NAE55/SNE/SNC (Johnson Controls): 12.0.4, 11.0.6Facility Explorer F4-SNC (Johnson Controls): 12.0.4, 11.0.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnson Controls | Metasys NAE55/SNE/SNC | 12.0 to before 12.0.4; 11.0 to before 11.0.6 | 12.0.4, 11.0.6 | Patch available | CNA |
| Johnson Controls | Facility Explorer F4-SNC | 12.0 to before 12.0.4; 11.0 to before 11.0.6 | 12.0.4, 11.0.6 | Patch available | CNA |
- Metasys NAE55/SNE/SNC VendorJohnson Controls Affected 12.0 to before 12.0.4; 11.0 to before 11.0.6 Fixed in 12.0.4, 11.0.6 Patch available CNA
- Facility Explorer F4-SNC VendorJohnson Controls Affected 12.0 to before 12.0.4; 11.0 to before 11.0.6 Fixed in 12.0.4, 11.0.6 Patch available CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:johnsoncontrols:nae55_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:nae55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:sne22000_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:sne22000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:sne11000_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:sne11000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:sne10500_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:sne10500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:sne110l0_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:sne110l0:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
- cpe:2.3:o:johnsoncontrols:nae55_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:nae55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:sne22000_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:sne22000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:sne11000_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:sne11000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:sne10500_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:sne10500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:sne110l0_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:sne110l0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:johnsoncontrols:snc25150-0_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:snc25150-0:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:snc25150-04_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:snc25150-04:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:snc16120-0_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:snc16120-0:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:snc16120-04_firmware:*:*:*:*:*:*:*:* | before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:snc16120-04:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:f4-snc_firmware:*:*:*:*:*:*:*:* | before 11.0.6; 12.0.0 to before 12.0.4 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:f4-snc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
- cpe:2.3:o:johnsoncontrols:snc25150-0_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:snc25150-0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:snc25150-04_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:snc25150-04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:snc16120-0_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:snc16120-0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:snc16120-04_firmware:*:*:*:*:*:*:*:* Versions before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:snc16120-04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:f4-snc_firmware:*:*:*:*:*:*:*:* Versions before 11.0.6; 12.0.0 to before 12.0.4 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:f4-snc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
Remediation
- Fix · CNA Metasys NAE55/SNE/SNC (Johnson Controls) Fixed in 12.0.4, 11.0.6
- Fix · CNA Facility Explorer F4-SNC (Johnson Controls) Fixed in 12.0.4, 11.0.6
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4486
- 2026-10-03 Alias added: GHSA-88j9-xvhv-gwc6
References
More Johnson Controls F4-snc Firmware vulnerabilities
- TI-2021-09109 Improper privilege management in Johnson Controls Facility Explorer SNC Series… CVSS 3.1HIGH 8.8
Sources
- CVE-2023-4486 · CVE Program
- CVE-2023-4486 · NVD
- FIRST EPSS
- GHSA-88j9-xvhv-gwc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences