What’s Vulnerable › Vulnerabilities

CVE-2022-21936: Metasys MVE

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-07 · updated 2026-06-17
• Weakness: CWE-287

Description

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.

Affected products

• Johnsoncontrols Metasys Extended Application And Data Server: 12.0

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-01
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-01
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Get alerted when CVE-2022-21936 or the next vulnerability affects your stack