Johnson Controls Metasys Products Command Injection Vulnerability Allowing Remote SQL Execution

A command injection vulnerability has been identified in several Johnson Controls Metasys components, including the Application and Data Server (ADS), Extended Application and Data Server (ADX), LCS8500, NAE8500, System Configuration Tool (SCT), and Controller Configuration Tool (CCT). This vulnerability affects Metasys versions 14.1 and prior, as well as SQL Express installations deployed with these applications. Successful exploitation could allow for remote execution of SQL commands, potentially leading to unauthorized data modification or deletion.

Impact

Exploitation of this vulnerability could result in remote execution of SQL commands, allowing an attacker to alter or delete data.