High severity7.5NVD Advisory· Published Dec 7, 2023· Updated Jun 17, 2026
CVE-2023-4486
CVE-2023-4486
Description
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- cpe:2.3:o:johnsoncontrols:f4-snc_firmware:*:*:*:*:*:*:*:*Range: <11.0.6
- cpe:2.3:o:johnsoncontrols:nae55_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:snc16120-04_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:snc16120-0_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:snc25150-04_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:snc25150-0_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:sne10500_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:sne11000_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:sne110l0_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
- cpe:2.3:o:johnsoncontrols:sne22000_firmware:*:*:*:*:*:*:*:*Range: <12.0.4
<11.0.6, <12.0.4+ 1 more
- (no CPE)range: <11.0.6, <12.0.4
- (no CPE)range: 12.0
- Range: <11.0.6, <12.0.4
- Johnson Controls/Metasys NAE55/SNE/SNCv5Range: 12.0
Patches
Vulnerability mechanics
References
2- www.cisa.gov/news-events/ics-advisories/icsa-23-341-03nvdThird Party AdvisoryUS Government Resource
- www.johnsoncontrols.com/cyber-solutions/security-advisoriesnvdVendor Advisory
News mentions
0No linked articles in our index yet.