Johnson Controls Device CVE-2025-43875

Exploitation requires low-privilege authenticated access to the affected Johnson Controls device (PR:L), after which a network-reachable interface accepts attacker input that is passed into an OS command (CWE-78). The limiting factor is the authentication requirement - an attacker must already hold valid, if low-level, credentials - so this is not exploitable by a fully unauthenticated remote attacker. No user interaction is required (UI:N) and attack complexity is low (AC:L). The exact feature, endpoint, and affected device model/configuration are not specified in the available data and must be confirmed via Johnson Controls advisory and CISA ICSA-25-345-01.

This is a genuine priority rather than a CVSS-inflated non-issue, though the vague description warrants verification. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) describes a network-reachable, low-complexity, OS command injection (CWE-78) that an attacker with low-level credentials can leverage for full confidentiality, integrity, and availability compromise of the device - effectively device takeover. The key mitigating signal is PR:L: exploitation requires some authenticated foothold, so this is not a pre-auth remote flaw. No EPSS score, KEV listing, or POC availability was provided in the input, so there is no evidence of active or automated exploitation; the signals do not conflict so much as remain incomplete. The presence of a CISA ICS advisory (ICSA-25-345-01) indicates this affects an industrial/building-automation device, where authenticated command injection is operationally serious because such devices often sit on flat OT networks with shared or weak credentials. Note the description ('access to the device') is unusually terse and does not confirm the command-injection mechanism - this is inferred from CWE-78 and the 'Command Injection' tag; verify the exact affected feature and product with the Johnson Controls advisory before prioritizing patch windows.

An attacker who has obtained low-privilege credentials to a Johnson Controls device management interface sends a crafted request containing shell metacharacters into a parameter that is passed to an OS command, achieving arbitrary command execution on the device. Given AV:N/AC:L, this is reliably reachable over the network with no user interaction once authenticated. No public exploit code was identified at time of analysis, so this would currently require attacker-developed tooling.