Metasys product command injection vulnerability could allow remote SQL execution
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects
* Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation,
* Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation,
* LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1,
* System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior,
* Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-77 | CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') |
Type: CWE
Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 4.0 | 9.5 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Version: 4.0
Base score: 9.5
Base severity: CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Impacts
| CAPEC ID | Description |
|---|
| CAPEC-248 | CAPEC-248 Command Injection |
Description: CAPEC-248 Command Injection