Johnson Controls Metasys SCT Pro

An attacker could probe your Metasys configuration tool to discover which internal systems and file paths exist on your network, enabling reconnaissance for follow-up attacks. This is passive reconnaissance—the attacker gains information about your environment without triggering obvious alarms.

Building automation system administrators and operators responsible for Metasys-based HVAC, lighting, and facility controls should prioritize this. Any organization using SCT or SCT Pro for configuration and management of Johnson Controls building automation equipment is affected.

An attacker sends specially crafted requests to the SCT or SCT Pro tool from the network. The tool responds differently when a file or system path exists versus when it doesn't, allowing the attacker to enumerate internal systems and their locations. No authentication is required—the attacker can probe the tool directly to map your building automation infrastructure.