Johnson Controls Device CVE-2025-43876

Exploitation requires low-privilege authentication to the device (PR:L), a network path to its affected interface (AV:N), and no user interaction (UI:N), targeting an OS command injection weakness (CWE-78). The vendor description explicitly scopes this to 'certain circumstances,' indicating a non-default or feature/configuration-dependent code path rather than universal exploitability - the exact triggering feature or setting is not disclosed in the available data and must be confirmed via CISA ICSA-25-345-01 and the Johnson Controls advisory. The principal limiting factors are the need for valid (if minimal) credentials and these unspecified preconditions; the primary risk amplifier is that successful injection yields full confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) on the device.

This is a CVSS 4.0 8.7 (High) OS command injection flaw (CWE-78) in a Johnson Controls device, carrying a network-exploitable vector (AV:N/AC:L/AT:N) requiring low-level authentication (PR:L) and no user interaction, with full high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H) and no scope change to subsequent systems. The combination of remote reachability, low complexity, and complete system compromise makes the theoretical severity genuine. However, key real-world risk signals are absent: no EPSS score is provided, the CVE is NOT on the CISA KEV catalog, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description is extremely vague ('Under certain circumstances a successful exploitation could result in access to the device'), which conflicts with the precision of the CVSS vector; the qualifier 'under certain circumstances' implies non-default or feature-specific preconditions that the CVSS AC:L/AT:N rating does not reflect - verify exact prerequisites with the Johnson Controls advisory and CISA ICSA-25-345-01. Because this affects industrial/building-automation equipment, real-world risk is better characterized as targeted (ICS/OT threat actors) rather than opportunistic mass exploitation. Net: a credible priority for organizations running the affected JCI product, but not demonstrably under active exploitation.

An attacker with low-privilege authenticated access to the device's network-facing management interface submits input that is passed unsanitized into an operating-system command (CWE-78), injecting attacker-controlled commands. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this can be done remotely without user interaction once minimal credentials are obtained, yielding command execution and full access to the device. No public proof-of-concept exploit is referenced in the available data.