Johnson Controls Metasys

An attacker with valid Metasys user credentials could gain administrator access to the building automation system, allowing them to modify HVAC setpoints, disable alarms, or disrupt operations affecting occupant comfort and safety.

This affects any organization using Johnson Controls Metasys building automation systems, including water utilities, municipal electric utilities, hospitals, data centers, and commercial/industrial facilities that rely on Metasys for HVAC, lighting, and energy management. Risk is highest for systems where non-administrative staff have user accounts.

An attacker with a standard user account on the Metasys server can exploit a privilege escalation flaw to gain administrator rights. Once elevated, the attacker can modify building automation settings, disable safety features, or shut down HVAC systems controlling the facility. The attacker must already have a valid user credential to access the Metasys interface (network or direct access to the server).