CVE-2019-7593 is a hard-coded cryptographic key vulnerability (CWE-798) in Johnson Controls Metasys building automation software: ADS/ADX servers and NAE/NIE/NCE engines before version 9.0 share a single RSA key pair across installations for Site Management Portal encryption, and NVD rates the resulting confidentiality and integrity impact 9.1 (critical) on CVSS v3.0.
Vulnerability summary
9.1
Critical
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2019-08-20
Published
Vulnerability ID: CVE-2019-7593 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Johnson Controls Metasys System (ADS/ADX servers and NAE/NIE/NCE engines) | cpe:2.3:a:johnsoncontrols:metasys_system:*:*:*:*:*:*:*:* | Metasys ADS/ADX servers and NAE/NIE/NCE engines before version 9.0 (NVD CPE: versionEndExcluding 9.0) |
What does this mean for affected devices?
CVE-2019-7593 affects the Metasys building automation system from Johnson Controls, used to manage HVAC, lighting and other building-wide controls. NVD's description states: "Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP)" (NVD).
NVD records a Primary CVSS v3.0 base score of 9.1 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact and no availability impact, consistent with an attacker decrypting or tampering with SMP traffic rather than crashing the engine. Johnson Controls' own CNA submission scores the same flaw lower, 6.8 (medium) under vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, reflecting a higher attack complexity and required user interaction in the vendor's own risk model; NVD also carries a legacy CVSS v2.0 Primary score of 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) (NVD).
NVD's CPE applicability data scopes the affected product to cpe:2.3:a:johnsoncontrols:metasys_system with versionEndExcluding 9.0, meaning all Metasys ADS/ADX server and NAE/NIE/NCE engine installations on releases prior to 9.0 share the vulnerable key pair (NVD).
The flaw is documented in CISA's ICS advisory ICSA-19-227-01 ("Johnson Controls Metasys"), which NVD lists as a Mitigation / Third Party Advisory / US Government Resource reference and which also covers the related certificate-trust issue CVE-2019-7594; the advisory's stated vendor mitigation is to upgrade to Metasys version 9.0 or later and configure sites to use trusted certificates rather than the shared default key material (CISA ICSA-19-227-01). Johnson Controls published the same fix guidance directly in its own product security advisory PDF, JCI-PSA-2019-06 (Johnson Controls JCI-PSA-2019-06).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0082 (57.5th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Operators running Metasys ADS/ADX or NAE/NIE/NCE components below version 9.0 should upgrade and move affected sites onto individually issued, trusted certificates rather than relying on the factory-shared RSA key pair for Site Management Portal encryption.
Evidence
- Metasys ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). — NVD
- NVD Primary CVSS v3.0 score 9.1 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; Johnson Controls' CNA Secondary score is 6.8 under a higher-complexity vector; a legacy NVD Primary CVSS v2.0 score of 6.4 is also recorded. CPE applicability scopes the Metasys System product to versions before 9.0. — NVD
- Documented in CISA ICS advisory ICSA-19-227-01 ("Johnson Controls Metasys"), covering CVE-2019-7593 and CVE-2019-7594, with vendor mitigation to upgrade to Metasys 9.0+ and use trusted certificates. — CISA ICSA-19-227-01
- Johnson Controls published its own product security advisory PDF (JCI-PSA-2019-06) for this CVE with the same upgrade-to-9.0 guidance. — Johnson Controls JCI-PSA-2019-06
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0082 (57.5th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What does the shared RSA key actually let an attacker do?
Because every affected Metasys installation uses the same factory RSA key pair for Site Management Portal encryption, an attacker who recovers that single private key can decrypt or tamper with SMP traffic on any affected deployment, not just one site (per NVD).
Why do NVD and Johnson Controls disagree on how severe this is?
NVD's Primary score is 9.1 (critical) assuming low attack complexity and no user interaction, while Johnson Controls' own CNA submission scores the identical flaw 6.8 (medium) assuming high attack complexity and required user interaction — the two assessments model the attacker's practical path differently, not the underlying flaw (per NVD; per Johnson Controls JCI-PSA-2019-06).
How should an affected Metasys site remediate this?
Johnson Controls' advisory directs customers to upgrade to Metasys version 9.0 or later and configure sites to use individually issued, trusted certificates instead of relying on the shared default key material (per CISA ICSA-19-227-01; per Johnson Controls JCI-PSA-2019-06).
Is there a related CVE affecting the same Metasys components?
Yes — CISA's advisory ICSA-19-227-01 covers this CVE alongside CVE-2019-7594, a related certificate-trust issue in the same Metasys ADS/ADX and NAE/NIE/NCE product line (per CISA ICSA-19-227-01).