CVE record · CVE-2020-9044

Metasys Improper Restriction of XML External Entity Reference

CVSS 7.5 HighEPSS 0.013 · 70th percentile

Published by the CVE Program (CNA: jci) at 10 Mar 2020, 19:28 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Johnson Controls	Metasys Application and Data Server (ADS, ADS-Lite)	affected versions 10.1 and prior
Johnson Controls	Metasys Extended Application and Data Server (ADX)	affected versions 10.1 and prior
Johnson Controls	Metasys Open Data Server (ODS)	affected versions 10.1 and prior
Johnson Controls	Metasys Open Application Server (OAS)	affected version 10.1
Johnson Controls	Metasys Network Automation Engine (NAE55 only)	affected versions 9.0.1 affected 9.0.2 affected 9.0.3 affected 9.0.5 affected 9.0.6
Johnson Controls	Metasys Network Integration Engine (NIE55/NIE59)	affected versions 9.0.1 affected 9.0.2 affected 9.0.3 affected 9.0.5 affected 9.0.6
Johnson Controls	Metasys NAE85 and NIE85	affected versions 10.1 and prior
Johnson Controls	Metasys LonWorks Control Server (LCS)	affected versions 10.1 and prior
Johnson Controls	Metasys System Configuration Tool (SCT)	affected versions 13.2 and prior
Johnson Controls	Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)	affected version 8.1

Identifiers: CVE-2020-9044
CNA: jci
Weakness (CWE): CWE-611
Tags: Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite)
Johnson Controls Metasys Extended Application and Data Server (ADX)
Johnson Controls Metasys Open Data Server (ODS)
Johnson Controls Metasys Open Application Server (OAS)
Johnson Controls Metasys Network Automation Engine (NAE55 only)
Johnson Controls Metasys Network Integration Engine (NIE55/NIE59)
Johnson Controls Metasys NAE85 and NIE85
Johnson Controls Metasys LonWorks Control Server (LCS)
XML external entities (XXE)
Published: 10 Mar 2020
Updated: 4 Aug 2024

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CNA (jci)

CISA KEV Not listed.
EPSS 0.013, the 70th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 10 Mar 2020. New records show when each source confirmed them.

Sources

References from the CNA

www.johnsoncontrols.com/cyber-solutions/security-advisories confirm
www.us-cert.gov/ics/advisories/icsa-20-070-05 third-party-advisorycert

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.