CVE-2025-26385: Johnson Controls Metasys - Command Injection in SQL Express Deployments

Overview

Johnson Controls has disclosed CVE-2025-26385, a command injection weakness (CWE-77) in several Metasys components and related configuration tools. According to the record, the flaw is tied to installations that include SQL Express, and successful exploitation could allow remote SQL execution.

Impact

• The CVSS metrics supplied by the CNA, as recorded, describe a network-reachable attack with low attack complexity, no privileges and no user interaction, with attack requirements marked as present.
• The same metrics assign high impact to confidentiality, integrity and availability of the vulnerable system.
• Remote SQL execution, as described by the CNA, could expose or modify data held by the affected database component. The record does not detail the precise data or functions at risk.

Affected products and versions

• Metasys Application and Data Server (ADS) with SQL Express, as part of Metasys 14.1 and prior.
• Extended Application and Data Server (ADX) with SQL Express, as part of Metasys 14.1.
• LCS8500 or NAE8500 with SQL Express, as part of Metasys releases 12.0 through 14.1.
• System Configuration Tool (SCT) with SQL Express, as part of SCT 17.1 and prior.
• Controller Configuration Tool (CCT) with SQL Express, as part of CCT 17.0 and prior.

The structured affected field in the record is empty, so the list above comes from the description text only.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed. No confirmed exploitation appears in the sources consulted. No EPSS or SSVC data is present in the record.

Remediation and mitigation

• The record contains no fixed versions. Check the Johnson Controls security advisories page and the CISA ICS advisory for vendor guidance on updates.
• Inventory every Metasys, ADX, LCS8500, NAE8500, SCT and CCT deployment and confirm whether SQL Express is installed as part of it.
• Restrict network access to these servers and their database interfaces, and place them in segmented operational technology zones.
• Apply least privilege to service and database accounts used by these applications.
• Prioritise systems that are reachable from less trusted networks.

Detection guidance

• Monitor SQL Express instances for unexpected query activity, new administrative actions or changes to database objects.
• Review application and database logs for anomalous requests originating from unexpected hosts.
• Alert on new or unusual network connections to Metasys servers and database ports from outside approved management systems.

Limitations of the available information

• No fixed or unaffected versions are listed in the record.
• The structured affected field is empty; affected releases are taken from the description.
• The record title was missing and the source status is Deferred.
• No NVD analysis, EPSS score or SSVC decision is included.
• The exact preconditions for exploitation and the specific SQL capabilities involved are not described.

Frequently asked questions

What is CVE-2025-26385?

It is a command injection weakness (CWE-77) in several Johnson Controls Metasys components and related configuration tools where SQL Express is deployed. The record says successful exploitation could allow remote SQL execution.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The description lists Metasys 14.1 and prior for ADS, Metasys 14.1 for ADX, Metasys releases 12.0 through 14.1 for LCS8500 and NAE8500, SCT 17.1 and prior, and CCT 17.0 and prior, when SQL Express is installed as part of them.

Is a fixed version available?

The record does not list fixed versions. Check the vendor advisory page and the CISA ICS advisory for current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.