Known vulnerabilities in Metasys ADX

Known vulnerabilities in Metasys ADX

Vendor: Johnson Controls

Software: Metasys ADX

Software CPE: cpe:2.3:a:johnson_controls:metasys_adx:*:*:*:*:*:*:*:*

Website: https://www.johnsoncontrols.com/

Total vulnerabilities: 11

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Vulnerabilities (11)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU71168 - Insufficiently Protected Credentials CVE-2021-36204	CWE-522	High	No	No	10.1.6, 11.0.3	13.01.2023	SB2023011325
#VU67916 - Improper Authentication CVE-2022-21936	CWE-287	Medium	No	No	12.0.1	05.10.2022	SB2022100506
#VU65738 - Missing Authentication for Critical Function CVE-2021-36200	CWE-306	Medium	No	No	10.1.6, 11.0.2	25.07.2022	SB2022072507
#VU64384 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-21938	CWE-79	Low	No	No	10.1.5, 11.0.2	15.06.2022	SB2022041903 SB2023060525
#VU64382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-21937	CWE-79	Low	No	No	10.1.5, 11.0.2	15.06.2022	SB2022041903
#VU64381 - Unverified Password Change CVE-2022-21935	CWE-620	Low	No	No	10.1.5, 11.0.2	15.06.2022	SB2022041903
#VU62832 - Unverified Password Change CVE-2022-21934	CWE-620	Medium	No	No	10.1.5, 11.0.2	06.05.2022	SB2022041903
#VU62691 - Improper Privilege Management CVE-2021-36207	CWE-269	Medium	No	No	10.1.5, 11.0.2	29.04.2022	SB2022041903
#VU62369 - Incomplete cleanup CVE-2021-36205	CWE-459	High	No	No	10.1.5, 11.0.2	19.04.2022	SB2022041903
#VU61491 - Improper Control of Generation of Code ('Code Injection') CVE-2021-36202	CWE-94	Medium	No	No	10.1.5, 11.0.2	21.03.2022	SB2022032110
#VU25987 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2020-9044	CWE-611	High	No	No	-	11.03.2020	SB2020031122