CVE-2014-5428

N/A

Published: March 29, 2015 at 10:00 AM UTC

Updated: June 17, 2026 at 12:11 AM UTC

12 products affected across 1 vendorMetsysLonworks Control Server Lcs8520Network Integration Engine 5510-2

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 4%

Description

Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Metsys · Johnsoncontrols

95%

4.1 6.5

johnsoncontrols-application-and-data-server (environment) · johnsoncontrols-extended-application-and-data-server (environment) · johnsoncontrols-lonworks-control-server-lcs8520 (environment) · johnsoncontrols-network-automation-engine-5510-2 (environment) · johnsoncontrols-network-automation-engine-5510-2u (environment) · johnsoncontrols-network-automation-engine-5511-2 (environment) · johnsoncontrols-network-automation-engine-5520-2 (environment) · johnsoncontrols-network-automation-engine-5521-2 (environment) · johnsoncontrols-network-integration-engine-5510-2 (environment) · johnsoncontrols-network-integration-engine-5511-2 (environment) · johnsoncontrols-nxe8500 (environment)

Application And Data Server · Johnsoncontrolsdevice

80%

All versions

Extended Application And Data Server · Johnsoncontrolsdevice

80%

All versions

Lonworks Control Server Lcs8520 · Johnsoncontrolsdevice

80%

All versions

Network Automation Engine 5510-2 · Johnsoncontrolsdevice

80%

All versions