CVE-2018-10624

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

Score

CVSS 3.0 6.5 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-08-01

Last modified

2026-09-10

Weaknesses

CWE-209, CWE-388

Affected products

• Bcpro Bcm (Johnson Controls)
• Metasys System (Johnson Controls)
• Bcpro (Johnsoncontrols)
• Metasys System (Johnsoncontrols)

References

• http://www.securityfocus.com/bid/104937
• https://www.cisa.gov/news-events/ics-advisories/icsa-18-212-02
• https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02