CVE-2018-10624mediumCWE-209

CVE-2018-10624: medium-severity vulnerability in Johnson Controls Metasys System

Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

Published · Updated

Follow this CVE+ Monitor BCPro+ Monitor Metasys System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.9%
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Johnson Controls · BCPro (BCM)Johnson Controls · Metasys System