Known vulnerabilities in Metasys ADS

Vendor: Johnson Controls
Software: Metasys ADS
Software CPE: cpe:2.3:a:johnson_controls:metasys_ads:*:*:*:*:*:*:*:*
Website: https://www.johnsoncontrols.com/
Total vulnerabilities: 10
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Metasys ADS Metasys ADS is affected by 10 known vulnerabilities: 3 high, 4 medium, 3 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU71168 - Insufficiently Protected Credentials
CVE-2021-36204		 CWE-522 High
No
No
 10.1.6, 11.0.3 13.01.2023 SB2023011325
#VU65738 - Missing Authentication for Critical Function
CVE-2021-36200		 CWE-306 Medium
No
No
 10.1.6, 11.0.2 25.07.2022 SB2022072507
#VU64384 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-21938		 CWE-79 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
SB2023060525
#VU64382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-21937		 CWE-79 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
#VU64381 - Unverified Password Change
CVE-2022-21935		 CWE-620 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
#VU62832 - Unverified Password Change
CVE-2022-21934		 CWE-620 Medium
No
No
 10.1.5, 11.0.2 06.05.2022 SB2022041903
#VU62691 - Improper Privilege Management
CVE-2021-36207		 CWE-269 Medium
No
No
 10.1.5, 11.0.2 29.04.2022 SB2022041903
#VU62369 - Incomplete cleanup
CVE-2021-36205		 CWE-459 High
No
No
 10.1.5, 11.0.2 19.04.2022 SB2022041903
#VU61491 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-36202		 CWE-94 Medium
No
No
 10.1.5, 11.0.2 21.03.2022 SB2022032110
#VU25987 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2020-9044		 CWE-611 High
No
No
 - 11.03.2020 SB2020031122