Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.
References
Link | Resource |
---|---|
https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02 | Third Party Advisory US Government Resource |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: icscert
Published: 2015-03-29T10:00:00
Updated: 2015-03-29T02:57:00
Reserved: 2014-08-22T00:00:00
Link: CVE-2014-5428
JSON object: View
NVD Information
Status : Analyzed
Published: 2015-03-29T10:59:01.400
Modified: 2015-03-30T18:45:25.753
Link: CVE-2014-5428
JSON object: View
Redhat Information
No data.
CWE