Johnson Controls PowerG CVE-2025-26379

Requires the attacker to be within wireless (RF) range of a PowerG-enabled device - the CVSS Adjacent vector (AV:A) is the binding prerequisite, so this cannot be exploited over the internet. The affected component is the PowerG encrypted wireless link, whose encryption relies on a weak pseudo-random number generator (CWE-338); any deployment using PowerG wireless communication is exposed by default (PR:N/UI:N, no special configuration needed). The practical limiting factors are physical/RF proximity to the targeted alarm system and the attacker's ability to capture and analyze live PowerG traffic to predict PRNG output.

This is a medium-severity, proximity-bound cryptographic weakness rather than a high-priority internet-facing threat. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.2 and tells a consistent story: exploitation requires wireless adjacency to a PowerG device (Adjacent, not Network), needs no authentication or user interaction, and yields high integrity impact (VI:H, packet injection) with lower confidentiality/availability impact (VC:L/VA:L). All supporting signals point AWAY from urgency: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is identified. The Adjacent attack vector is the dominant limiting factor - an attacker must be within RF range of the PowerG wireless security system, which precludes mass remote exploitation and favors targeted, physically-local attacks. The input 'Code Injection' tag conflicts with both CWE-338 (weak PRNG) and the description, which describes encrypted-packet read/injection, not arbitrary code execution - treat the tag as suspect. Net: a real but situational flaw affecting physical-security infrastructure; prioritize for sites where alarm/intrusion integrity is critical, but it does not warrant emergency patching based on exploitation likelihood.

An attacker positioned within wireless range of a PowerG-based intrusion/alarm system captures traffic and exploits the weak pseudo-random number generator (CWE-338) to predict keystream material, allowing them to decrypt (read) or forge (inject) encrypted PowerG packets. This could let the attacker spoof sensor status or suppress/falsify alarm signaling. No public exploit code has been identified at time of analysis.