« Volver al listado

CVE-2025-26385

Estado: AplazadaCrítica (9.5)—

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects

Detalles técnicos trazas, registros y código del informe original
  *  Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, 
  *  Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, 
  *  LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, 
  *  System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, 
  *  Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-77 (command injection) en aplicación expuesta en red (AV:N, PR:N) permite ejecución remota de comandos SQL sin autenticación. Impactos: ejecución de comandos y manipulación de datos en BD.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (6)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Johnsoncontrols — Controller Configuration ToolAIJohnsoncontrols — Lcs8500AIJohnsoncontrols — Metasys Application AND Data ServerAIJohnsoncontrols — Metasys Extended Application AND Data ServerAIJohnsoncontrols — Nae8500AIJohnsoncontrols — System Configuration ToolAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-26385",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26385",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-30T12:37:58.863009Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "productsecurity@jci.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@jci.com",
      "affectedData": [
        {
          "vendor": "Johnson Controls",
          "modules": [
            "Application and Data Server (ADS)",
            "Extended Application and Data Server",
            "LCS8500 or NAE8500  (ADX)",
            "Controller Configuration Tool (CCT)",
            "System Configuration Tool (SCT)"
          ],
          "product": "Metasys",
          "versions": [
            {
              "status": "affected",
              "version": "Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-30T11:15:53.467",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-04",
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories",
      "source": "productsecurity@jci.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@jci.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Johnson Controls Metasys component listed below have  Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects \n\n\n\n  *  Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, \n  *  Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, \n  *  LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, \n  *  System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, \n  *  Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior."
    },
    {
      "lang": "es",
      "value": "El componente Metasys de Johnson Controls que se enumera a continuación tiene una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando (inyección de comandos). La explotación exitosa de esta vulnerabilidad podría permitir la ejecución remota de SQL. Este problema afecta a\n\n* Metasys: Servidor de Aplicaciones y Datos (ADS) instalado con SQL Express implementado como parte de la instalación de Metasys 14.1 y anteriores,\n* Servidor de Aplicaciones y Datos Extendido (ADX) instalado con SQL Express implementado como parte de la instalación de Metasys 14.1,\n* LCS8500 o NAE8500 instalado con SQL Express implementado como parte de la instalación de Metasys Versiones 12.0 a 14.1,\n* Herramienta de Configuración del Sistema (SCT) instalado con SQL Express implementado como parte de la instalación de SCT 17.1 y anteriores,\n* Herramienta de Configuración del Controlador (CCT) instalado con SQL Express implementado como parte de la instalación de CCT 17.0 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T09:01:40.920",
  "sourceIdentifier": "productsecurity@jci.com"
}