Heimdall Security Logo

CVE-2025-26385

Vulnérabilité critique dans Metasys (Johnson Controls)

CVSS 9.5 · Critique
EPSS 1.5%
Johnson Controls•Metasys•Versions : Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior

Description

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects  * Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation,  * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation,  * LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1,  * System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior,  * Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.

Gravité et risque d'exploitation

CVE-2025-26385 obtient un score CVSS de 9.5/10, soit une gravité critique. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 1.50 %, ce qui la place devant 73.8 % des CVE référencées.

Que faire ?

  • Vérifiez si Metasys (versions Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE