Unrated severityNVD Advisory· Published Dec 7, 2023· Updated May 28, 2025

Uncontrolled Resource Consumption in Metasys and Facility Explorer

CVE-2023-4486

Description

Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to

versions 11.0.6 and 12.0.4

and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Johnson Controls/Facility Explorer F4-SNCllm-create2 versions
< 11.0.6 & < 12.0.4+ 1 more
- (no CPE)range: < 11.0.6 & < 12.0.4
- (no CPE)range: 12.0
Johnson Controls/Metasysllm-fuzzy
Range: < 11.0.6 & < 12.0.4
Johnson Controls/Metasys NAE55/SNE/SNCv5
Range: 12.0

Patches

Vulnerability mechanics

References

www.cisa.gov/news-events/ics-advisories/icsa-23-341-03mitre
www.johnsoncontrols.com/cyber-solutions/security-advisoriesmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000