10

CVE-2014-5428

EPSS 3.95%
Veröffentlicht 29.03.2015 10:59:01
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle ics-cert@hq.dhs.gov
CVE-Watchlists
Login
Unerledigt
Login

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 4

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Johnsoncontrols ≫ Metsys Version4.1

   Johnsoncontrols ≫ Application And Data Server Version-
   Johnsoncontrols ≫ Extended Application And Data Server Version-
   Johnsoncontrols ≫ Lonworks Control Server Lcs8520 Version-
   Johnsoncontrols ≫ Network Automation Engine 5510-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5510-2u Version-
   Johnsoncontrols ≫ Network Automation Engine 5511-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5520-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5521-2 Version-
   Johnsoncontrols ≫ Network Integration Engine 5510-2 Version-
   Johnsoncontrols ≫ Network Integration Engine 5511-2 Version-
   Johnsoncontrols ≫ Nxe8500 Version-

Johnsoncontrols ≫ Metsys Version6.5

   Johnsoncontrols ≫ Application And Data Server Version-
   Johnsoncontrols ≫ Extended Application And Data Server Version-
   Johnsoncontrols ≫ Lonworks Control Server Lcs8520 Version-
   Johnsoncontrols ≫ Network Automation Engine 5510-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5510-2u Version-
   Johnsoncontrols ≫ Network Automation Engine 5511-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5520-2 Version-
   Johnsoncontrols ≫ Network Automation Engine 5521-2 Version-
   Johnsoncontrols ≫ Network Integration Engine 5510-2 Version-
   Johnsoncontrols ≫ Network Integration Engine 5511-2 Version-
   Johnsoncontrols ≫ Nxe8500 Version-

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.95%	0.891

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02

Third Party Advisory

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2014-5428

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-5428

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-5428

EUVD