Johnson Controls Metasys NAE55 / SNE / SNC network engines and Facility Explorer F4-SNC (before 11.0.6 / 12.0.4)

Impact

Sending invalid credentials to the login endpoint knocks the engine over. These engines are not dashboards - they are the supervisory controllers that execute the control logic for air handlers, CRAHs and chilled-water plant, and coordinate the field controllers under them. Denial of service on an NAE or SNE means the hall loses coordinated thermal control and falls back to whatever the individual field controllers do standalone, which is typically last-known-value or a crude failsafe. With a 40-140 kW rack density and no supervisory loop closing on actual return-air temperature, you are running blind during exactly the period a competent attacker would also be driving load or blocking alarms. It is trivially repeatable, needs no valid credentials, and can be held indefinitely - so it is a sustained availability attack on the hall rather than a one-shot.

Who can reach it

Unauthenticated TCP to the engine's login endpoint on the facility network. Metasys engines are field-mounted in mechanical rooms and IDF closets and sit on the building VLAN; they are frequently reachable from anywhere on that VLAN with no ACL, because the assumption is that only the ADS talks to them. In practice the mechanical contractor's laptop, the fire-alarm integrator's gateway and the landlord's network all live there too.

What to do

Firmware update on each engine to 11.0.6 / 12.0.4 or later. That is a controller flash, done by a Johnson Controls technician or certified integrator, engine by engine, with each engine offline during the flash - meaning a real maintenance window on live cooling that many operators will not schedule during peak season. Realistic interim control is an ACL that permits the engine's login port only from the ADS, which removes the attack surface without touching firmware. In a leased colo you cannot flash the landlord's engines: require the firmware version in writing and make DoS resilience of the mechanical control layer an explicit item in the SLA conversation, because a cooling outage caused by the landlord's unpatched engine still kills your training run.

References