Metasys Improper Restriction of XML External Entity Reference

7.5 CVSS

Vulnerability Description

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-9044

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Lukasz Rupala

References

More from Johnson Controls

View All →

CVE-2025-61740

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

High 7.2

CVE-2025-61739

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

High 7.2

CVE-2025-61738

Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

Low 2.3

CVE-2025-61736

iSTAR- Improper Validation of Certificate Expiration

High 7.1

CVE-2025-43876

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

High 8.7

Affected Vendor

Johnson Controls

View all reports →

Affected Software

Metasys Application and Data Server (ADS, ADS-Lite), Metasys Extended Application and Data Server (ADX), Metasys Open Data Server (ODS), Metasys Open Application Server (OAS), Metasys Network Automation Engine (NAE55 only), Metasys Network Integration Engine (NIE55/NIE59), Metasys NAE85 and NIE85, Metasys LonWorks Control Server (LCS), Metasys System Configuration Tool (SCT), Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)

Vulnerable Versions:

versions 10.1 and prior, version 10.1, versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6, versions 13.2 and prior, version 8.1