Johnson Controls ICS CVE-2025-61740

Exploitation requires the attacker to be on the same adjacent/Layer-2 network segment as the device (AV:A) - the flaw is not exploitable across the routed internet. The core condition is that the device does not verify the source of inbound packets (CWE-346 origin validation failure), allowing spoofed packets to be accepted. No authentication (PR:N) and no user interaction (UI:N) are needed, and default configurations appear affected per the description. LIMITING FACTORS: the adjacent-network requirement means the attacker must already have access to the local/management network, which confines realistic exploitation to insiders or attackers who have breached the facility network; the specific affected Johnson Controls product/version must also be present.

The input CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated attack reachable only from an adjacent network segment, yielding high integrity impact (VI:H, device configuration modification) with lower confidentiality and availability impact - consistent with the CWE-346 origin-validation / packet-source-spoofing root cause. This is a genuine but situational priority: the integrity impact and lack of authentication are serious, but the adjacent-network vector (not internet-routable) and the CISA ICS advisory context substantially narrow real-world reach. The EPSS score is very low (0.13%, 3rd percentile) and there is no CISA KEV listing and no public POC, so all exploitation signals point to no active or imminent widespread exploitation - the severity is driven by potential impact, not by observed activity. CONFLICT TO NOTE: the only descriptive tag is 'Information Disclosure', yet the description and the vector (VI:H, VA:L, VC:L) center on configuration modification and denial-of-service, not disclosure - verify the primary impact category with the Johnson Controls advisory. The specific affected product and versions are not provided in this input and must be confirmed from the vendor/CISA advisories.

An attacker positioned on the same (adjacent) network segment as a Johnson Controls device sends spoofed or forged packets that the device fails to validate the origin of (CWE-346). Because no authentication or user interaction is required, the attacker can push unauthorized configuration changes to the device or force it into a denial-of-service state. No public exploit code is known, so exploitation would require custom packet crafting against the specific protocol.