EUVD-2026-67140
GHSA-h5wr-2px2-58v4
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required per description and AV:P; debug interface requires no privileges; high availability impact but no confidentiality impact and unchanged scope.
Primary rating from Vendor (jci).
CVSS VectorVendor: jci
Lifecycle Timeline
2DescriptionCVE.org
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects T2000: before 31.6.
AnalysisAI
Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the T2000 hardware is the primary and mandatory prerequisite, confirmed by the CVSS 4.0 AV:P (Physical) attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.2 (Medium) accurately reflects the physical access constraint (AV:P), which substantially limits opportunistic or remote exploitation and rules out network-based mass attack campaigns. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade T2000 firmware to version 31.6 or later, per the vendor patch availability confirmed by Johnson Controls and the EUVD-2026-67140 entry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today