CVE-2014-5428

Published: Mar 29, 2015Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.

Affected (2)

Products: Johnsoncontrols: Metsys

Johnsoncontrols

1 product

Metsys

Configuration A

2 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Johnsoncontrols Metsys	Version 4.1
Johnsoncontrols Metsys	Version 6.5

Running on/with	Platform Versions
Johnsoncontrols Application And Data Server	All versions
Johnsoncontrols Extended Application And Data Server	All versions
Johnsoncontrols Lonworks Control Server Lcs8520	All versions
Johnsoncontrols Network Automation Engine 5510 2	All versions
Johnsoncontrols Network Automation Engine 5510 2u	All versions
Johnsoncontrols Network Automation Engine 5511 2	All versions
Johnsoncontrols Network Automation Engine 5520 2	All versions
Johnsoncontrols Network Automation Engine 5521 2	All versions
Johnsoncontrols Network Integration Engine 5510 2	All versions
Johnsoncontrols Network Integration Engine 5511 2	All versions
Johnsoncontrols Nxe8500	All versions

References (2)

https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.