Johnson Controls Metasys Application and Data Server (ADS) deployed with SQL Express: Command injection on the Metasys

Impact

Command injection on the Metasys ADS that yields remote SQL execution. The ADS is the site's building-automation database and supervisory server: it holds the point database, the schedules, the trends and the operator accounts for every NAE/SNE/SNC engine driving air handling in the building. Getting arbitrary SQL - and, through it, the usual SQL-Server-to-OS escalation paths - means an attacker owns the system that both commands and reports on cooling. They can rewrite schedules and setpoints so the change persists, and rewrite the trend history so the postmortem shows nothing anomalous. For a hall of 40 kW+ racks that is fleet-wide availability risk with an intact-looking dashboard, which is the worst combination for an operator trying to diagnose why a training run just died.

Who can reach it

Network access to the Metasys ADS. Metasys servers are Windows machines that facilities teams routinely domain-join and expose to the corporate network for the Site Management Portal, so the realistic path is a corporate-network foothold rather than direct internet exposure - though internet-published SMP instances do exist. Anyone who compromises a facilities workstation is one hop away.

What to do

Vendor software update to the ADS per the Johnson Controls advisory - a server-side patch and a normal Windows change window, no controller firmware and no cooling downtime, so schedule it. Additionally: get the ADS off the corporate network segment entirely, restrict SQL Express to localhost, run the Metasys service account with least privilege, and require a jump host for SMP access. Leased colo: the Metasys ADS is the landlord's building server and typically serves all tenants - you cannot patch it, so make its version and network placement a contractual disclosure and demand notification when JCI publishes an advisory.

References