Known vulnerabilities in Metasys ADS 10

Vendor: Johnson Controls
Software: Metasys ADS
Version: 10
Software CPE: cpe:2.3:a:johnson_controls:metasys_ads:*:*:*:*:*:*:*:*
Website: https://www.johnsoncontrols.com/
Total vulnerabilities: 9
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Metasys ADS version 10 Metasys ADS 10 is affected by 9 vulnerabilities: 2 high, 4 medium, 3 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU71168 - Insufficiently Protected Credentials
CVE-2021-36204		 CWE-522 High
No
No
 10.1.6, 11.0.3 13.01.2023 SB2023011325
#VU65738 - Missing Authentication for Critical Function
CVE-2021-36200		 CWE-306 Medium
No
No
 10.1.6, 11.0.2 25.07.2022 SB2022072507
#VU64384 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-21938		 CWE-79 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
SB2023060525
#VU64382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-21937		 CWE-79 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
#VU64381 - Unverified Password Change
CVE-2022-21935		 CWE-620 Low
No
No
 10.1.5, 11.0.2 15.06.2022 SB2022041903
#VU62832 - Unverified Password Change
CVE-2022-21934		 CWE-620 Medium
No
No
 10.1.5, 11.0.2 06.05.2022 SB2022041903
#VU62691 - Improper Privilege Management
CVE-2021-36207		 CWE-269 Medium
No
No
 10.1.5, 11.0.2 29.04.2022 SB2022041903
#VU62369 - Incomplete cleanup
CVE-2021-36205		 CWE-459 High
No
No
 10.1.5, 11.0.2 19.04.2022 SB2022041903
#VU61491 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-36202		 CWE-94 Medium
No
No
 10.1.5, 11.0.2 21.03.2022 SB2022032110