CVE-2025-26385: Johnson Controls Metasys SQLi Vulnerability

CVE-2025-26385 Overview

CVE-2025-26385 is a critical Command Injection vulnerability affecting multiple Johnson Controls Metasys components. The vulnerability stems from improper neutralization of special elements used in commands (CWE-77), which could allow attackers to execute remote SQL commands on vulnerable systems. This vulnerability is particularly concerning given its presence in building automation and industrial control system (ICS) environments where Metasys is widely deployed.

Critical Impact

Successful exploitation of this vulnerability could allow unauthenticated remote attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of building automation systems and connected infrastructure.

Affected Products

• Metasys Application and Data Server (ADS) installed with SQL Express deployed as part of Metasys 14.1 and prior
• Metasys Extended Application and Data Server (ADX) installed with SQL Express deployed as part of Metasys 14.1 installation
• LCS8500 or NAE8500 installed with SQL Express deployed as part of Metasys installation Releases 12.0 through 14.1
• System Configuration Tool (SCT) installed with SQL Express deployed as part of SCT installation 17.1 and prior
• Controller Configuration Tool (CCT) installed with SQL Express deployed as part of CCT installation 17.0 and prior

Discovery Timeline

• 2026-01-30 - CVE-2025-26385 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-26385

Vulnerability Analysis

This command injection vulnerability exists within the Johnson Controls Metasys building automation platform when deployed with SQL Express databases. The vulnerability allows attackers to inject and execute arbitrary SQL commands remotely without requiring authentication. The network-accessible nature of the vulnerability combined with the lack of required privileges makes this a particularly dangerous attack surface for organizations relying on Metasys for critical building infrastructure management.

The vulnerability affects multiple Metasys components including the Application and Data Server (ADS), Extended Application and Data Server (ADX), network automation engines (NAE8500, LCS8500), and configuration tools (SCT, CCT). Each of these components, when installed with SQL Express as part of the standard deployment, becomes vulnerable to this command injection attack.

Root Cause

The root cause of CVE-2025-26385 is improper neutralization of special elements used in command construction (CWE-77). The affected Metasys components fail to properly sanitize or validate user-supplied input before incorporating it into SQL commands. This allows attackers to inject malicious SQL statements that are then executed by the underlying SQL Express database with the privileges of the database service account.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction and no prior authentication. An attacker with network access to the vulnerable Metasys components can craft specially formatted requests containing malicious SQL commands. These commands bypass input validation mechanisms due to improper neutralization of special characters, allowing the injected SQL to execute on the backend SQL Express database.

The vulnerability mechanism involves sending crafted input through the network interface that exploits the insufficient input sanitization in the Metasys application layer. When this input reaches the SQL Express database components, the injected commands are executed, potentially allowing attackers to read, modify, or delete data, as well as execute operating system commands depending on database configuration. For detailed technical information, refer to the CISA ICS Advisory ICSA-26-027-04.

Detection Methods for CVE-2025-26385

Indicators of Compromise

• Unusual SQL query patterns in Metasys database logs, particularly queries containing union statements, exec commands, or xp_cmdshell invocations
• Unexpected network connections to Metasys servers from external or unauthorized IP addresses
• Anomalous database activity including bulk data access, schema modifications, or new user account creation
• Evidence of SQL Express service account performing unusual system operations

Detection Strategies

• Implement network intrusion detection rules to identify SQL injection patterns in traffic destined for Metasys components
• Enable and monitor SQL Server audit logs for suspicious query activity and failed authentication attempts
• Deploy application-layer firewalls or web application firewalls (WAF) configured with SQL injection detection rules
• Utilize SentinelOne Singularity platform to detect anomalous process behavior associated with SQL Server exploitation

Monitoring Recommendations

• Continuously monitor network traffic to and from Metasys servers for unusual patterns or volumes
• Implement real-time alerting for SQL Express error logs and security events
• Establish baseline behavior profiles for Metasys database operations to identify deviations indicating potential exploitation

How to Mitigate CVE-2025-26385

Immediate Actions Required

• Isolate affected Metasys systems from untrusted networks and limit access to authorized personnel only
• Review and implement network segmentation to prevent unauthorized access to building automation system networks
• Audit current Metasys deployments to identify all instances using SQL Express components
• Apply the principle of least privilege to SQL Express service accounts and database users

Patch Information

Johnson Controls has released security guidance for this vulnerability. Organizations should consult the Johnson Controls Security Advisory for the latest patch information and recommended updates. CISA has also published detailed guidance in ICS Advisory ICSA-26-027-04 which should be reviewed for comprehensive remediation steps.

Workarounds

• Implement strict network access controls using firewalls to restrict access to Metasys components to only authorized management systems
• Consider deploying SQL Express on isolated network segments with no direct internet connectivity
• Enable SQL Server stored procedure filtering and disable dangerous extended stored procedures such as xp_cmdshell if not required
• Implement additional input validation at the network perimeter using application-aware security devices

# Network isolation configuration example for Metasys systems
# Restrict SQL Express access to authorized management stations only
# Example iptables rules for Linux-based network equipment

# Allow SQL Express access only from authorized management subnet
iptables -A INPUT -p tcp --dport 1433 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1433 -j DROP

# Log any blocked connection attempts for monitoring
iptables -A INPUT -p tcp --dport 1433 -j LOG --log-prefix "METASYS-SQL-BLOCKED: "