cveboard RSS feed

CVE-2020-9044

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2020
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Metasys Application and Data Server (ADS, ADS-Lite)

Vendor
Johnson Controls
Product
Metasys Application and Data Server (ADS, ADS-Lite)
Platforms
Unknown
Default status
Unknown
Metasys Application and Data Server (ADS, ADS-Lite) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 10.1 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys Extended Application and Data Server (ADX)

Vendor
Johnson Controls
Product
Metasys Extended Application and Data Server (ADX)
Platforms
Unknown
Default status
Unknown
Metasys Extended Application and Data Server (ADX) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 10.1 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys Open Data Server (ODS)

Vendor
Johnson Controls
Product
Metasys Open Data Server (ODS)
Platforms
Unknown
Default status
Unknown
Metasys Open Data Server (ODS) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 10.1 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys Open Application Server (OAS)

Vendor
Johnson Controls
Product
Metasys Open Application Server (OAS)
Platforms
Unknown
Default status
Unknown
Metasys Open Application Server (OAS) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
version 10.1affectedUnavailableUnavailableUnavailableNone listed

Metasys Network Automation Engine (NAE55 only)

Vendor
Johnson Controls
Product
Metasys Network Automation Engine (NAE55 only)
Platforms
Unknown
Default status
Unknown
Metasys Network Automation Engine (NAE55 only) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 9.0.1affectedUnavailableUnavailableUnavailableNone listed
9.0.2affectedUnavailableUnavailableUnavailableNone listed
9.0.3affectedUnavailableUnavailableUnavailableNone listed
9.0.5affectedUnavailableUnavailableUnavailableNone listed
9.0.6affectedUnavailableUnavailableUnavailableNone listed

Metasys Network Integration Engine (NIE55/NIE59)

Vendor
Johnson Controls
Product
Metasys Network Integration Engine (NIE55/NIE59)
Platforms
Unknown
Default status
Unknown
Metasys Network Integration Engine (NIE55/NIE59) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 9.0.1affectedUnavailableUnavailableUnavailableNone listed
9.0.2affectedUnavailableUnavailableUnavailableNone listed
9.0.3affectedUnavailableUnavailableUnavailableNone listed
9.0.5affectedUnavailableUnavailableUnavailableNone listed
9.0.6affectedUnavailableUnavailableUnavailableNone listed

Metasys NAE85 and NIE85

Vendor
Johnson Controls
Product
Metasys NAE85 and NIE85
Platforms
Unknown
Default status
Unknown
Metasys NAE85 and NIE85 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 10.1 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys LonWorks Control Server (LCS)

Vendor
Johnson Controls
Product
Metasys LonWorks Control Server (LCS)
Platforms
Unknown
Default status
Unknown
Metasys LonWorks Control Server (LCS) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 10.1 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys System Configuration Tool (SCT)

Vendor
Johnson Controls
Product
Metasys System Configuration Tool (SCT)
Platforms
Unknown
Default status
Unknown
Metasys System Configuration Tool (SCT) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
versions 13.2 and prioraffectedUnavailableUnavailableUnavailableNone listed

Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)

Vendor
Johnson Controls
Product
Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)
Platforms
Unknown
Default status
Unknown
Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
version 8.1affectedUnavailableUnavailableUnavailableNone listed