CVE-2023-4486
Uncontrolled Resource Consumption in Metasys and Facility Explorer
- Published
- Updated
- Reserved
- Assigned by
- jci
Description
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Timeline
ID reserved
By jci
- 4 months later
· 4 months later
Published
- 18 months later
· 18 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| jciCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.83% · top 42% of all CVEs (8 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
Johnson Controls · Metasys NAE55/SNE/SNC
- affected 12.0 – < 12.0.4
- affected 11.0 – < 11.0.6
Johnson Controls · Facility Explorer F4-SNC
- affected 12.0 – < 12.0.4
- affected 11.0 – < 11.0.6
What to do
Solution: Update Metasys NAE55, SNE, and SNC engines to version 12.0.4.
Solution: Update Metasys NAE55, SNE, and SNC engines to version 11.0.6.
Solution: Update Facility Explorer F4-SNC engine to version 12.0.4.
Solution: Update Facility Explorer F4-SNC engine to version 11.0.6.
Solution: For more information, contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-4486)Record last updated .