Johnson Controls Metasys

An attacker who obtains a valid session token from a logged-out user could gain unauthorized access to the Metasys building automation system, potentially allowing them to view sensitive building configuration, occupancy data, or manipulate HVAC and facility controls.

Building automation operators and facility managers at organizations using Johnson Controls Metasys ADS, ADX, or OAS servers for HVAC, lighting, and facility management should prioritize this update. This affects all mid-size and larger commercial buildings, data centers, hospitals, and municipal facilities that rely on Metasys for building control.

An attacker obtains a session token (via network interception, compromised workstation, or other means) and uses it to authenticate to the Metasys server after the legitimate user has logged out, since the token was not invalidated. The attack requires high technical complexity to capture and replay the token.