Neo Series Mvp2
Monthly
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.