Johnson Controls Airwall CVE-2026-64887

Exploitation requires local access to a system where the Airwall binary or firmware is accessible - confirmed by CVSS 4.0 AV:L. No specific privilege level is required on the local system (PR:N in the provided vector), meaning any user or process capable of reading the Airwall binary could perform extraction. The vulnerability is present in all Airwall versions before 4.1; deployments running 4.1 or later are not affected. Exploitation is constrained by the non-automatable SSVC assessment, meaning mass or remote exploitation without initial local foothold is not feasible. The primary limiting factor is the requirement for local binary or device access - remote unauthenticated exploitation is not possible given the local attack vector.

The CVSS 4.0 base score of 7.0 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N reflects high confidentiality impact (key extraction enables decryption) and low integrity impact (potential forgery), but the local attack vector materially constrains real-world exploitation. SSVC assessment reinforces this: Exploitation is none, Automatable is no, and Technical Impact is partial - meaning the vulnerability does not lend itself to automated, opportunistic attacks. The systemic nature of hard-coded keys is a compounding factor: a single key compromise affects all pre-patch deployments simultaneously, which elevates the organizational blast radius even if individual exploitation is non-trivial. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be independently quantified. The absence of KEV listing and SSVC Exploitation: none together support treating this as a priority remediation rather than an emergency incident response.

An attacker who obtains local access to a host running Airwall (through a separate compromise, insider access, or physical device acquisition) extracts the Airwall binary and reverse-engineers it to recover the embedded static cryptographic key. Using this key, the attacker can decrypt traffic protected by Airwall's cryptographic layer or potentially forge cryptographic assertions, undermining the product's network segmentation guarantees across all unpatched deployments. No publicly available exploit code has been identified at time of analysis.