Johnson Controls TL280 CVE-2026-27871

Exploitation requires that the attacker be positioned to intercept network communications between the TL280 and its communication counterpart, as indicated by AT:P (Attack Requirements: Present) in the CVSS 4.0 vector - this is not achievable from an arbitrary internet-sourced position without prior network access. No authentication is required (PR:N) and no victim interaction is needed (UI:N) once the attacker is in position. Exploitation is limited to TL280 firmware versions before 5.63. The SSVC assessment of 'Automatable: no' further confirms that reliable exploitation cannot be scripted at scale without meeting the network positioning prerequisite. The attack is further constrained to environments where TL280 device traffic is accessible to the attacker's segment.

The CVSS 4.0 base score of 2.9 (Low) reflects a meaningful constraint: AT:P (Attack Requirements: Present) limits opportunistic exploitation because the attacker must occupy a privileged network position to intercept TL280 communications. The AV:N/AC:L/PR:N/UI:N combination might suggest ease of exploitation in the abstract, but AT:P negates the 'fire and forget' threat model. SSVC independently confirms: exploitation status none, automatable no, technical impact partial - all consistent with a low-priority finding. The E:P modifier in the provided CVSS 4.0 supplemental vector suggests some exploit potential exists (e.g., known cryptanalysis tools applicable to the algorithm in use), but this is not the same as a weaponized, targeted exploit. No CISA KEV listing and no public POC have been confirmed at time of analysis. For physical security operators, however, the consequence of even partial decryption of alarm or access control communications could exceed what the low numeric score implies - risk should be contextualized against the sensitivity of the monitored environment.

An attacker who has gained a man-in-the-middle position on the network segment hosting the TL280 - for example via ARP spoofing on a shared LAN or rogue access point - captures encrypted traffic between the communicator and its backend receiver. The attacker then applies cryptanalytic techniques suited to the weak algorithm (e.g., brute-force against a short key, birthday collision, or known-plaintext recovery) to partially decrypt or forge communications, potentially reading limited alarm state data or injecting modified signals.