EUVD-2026-58763
GHSA-jpq8-c4g8-9mq5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N reflects network-exposed device; AC:H captures AT:P positioning requirement; PR:N and UI:N per CVSS 4.0 vector; limited C/I/A impact matches VC:L/VI:L/VA:L.
Primary rating from Vendor (jci).
CVSS VectorVendor: jci
Lifecycle Timeline
2DescriptionCVE.org
Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack.
This issue affects TL280: before 5.63.
AnalysisAI
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker be positioned to intercept network communications between the TL280 and its communication counterpart, as indicated by AT:P (Attack Requirements: Present) in the CVSS 4.0 vector - this is not achievable from an arbitrary internet-sourced position without prior network access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.9 (Low) reflects a meaningful constraint: AT:P (Attack Requirements: Present) limits opportunistic exploitation because the attacker must occupy a privileged network position to intercept TL280 communications. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade TL280 firmware to version 5.63 or later, which is confirmed available from Johnson Controls per vendor advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today