Johnson Controls Metasys ADS, ADX, OAS

An attacker could enumerate valid user accounts on your Metasys building automation system without credentials, enabling account enumeration for further targeted attacks. This could lead to unauthorized access to building control systems, potentially allowing manipulation of HVAC, lighting, and other building mechanical systems.

Building managers and facility engineers at organizations using Johnson Controls Metasys ADS, ADX, or OAS systems for central building automation and management. This includes utilities, hospitals, office buildings, data centers, and any facility relying on Metasys for HVAC, lighting, fire safety, and security system control.

An attacker on the network (or from the internet if the device is exposed) connects directly to the Metasys web API without providing credentials. The vulnerability allows the attacker to query API endpoints that should require authentication, extracting a list of valid user accounts. This information can then be used for password guessing, social engineering, or other follow-on attacks.