Johnson Controls T2000 CVE-2026-64896

Physical access to the T2000 hardware is the primary and mandatory prerequisite, confirmed by the CVSS 4.0 AV:P (Physical) attack vector. The debug or test interface must be physically accessible on the device - standard production units appear to leave this interface exposed. No authentication credentials are required to interact with the interface (PR:N), and no user interaction or network connectivity is needed. Exploitation is inherently limited to individuals who can physically reach the device. Devices installed in locked, access-controlled enclosures or server rooms with enforced visitor logging represent a significantly reduced exposure surface. There is no indication that this vulnerability is exploitable remotely or over any network interface.

The CVSS 4.0 score of 5.2 (Medium) accurately reflects the physical access constraint (AV:P), which substantially limits opportunistic or remote exploitation and rules out network-based mass attack campaigns. The high availability impact (VA:H) is the most operationally significant signal - in OT environments where T2000 units control HVAC, access, or facility systems, device disruption can cascade into safety or business continuity incidents. Low integrity impact (VI:L) indicates limited configuration modification is also possible. No EPSS data was provided, and the absence of a CISA KEV listing and any known public POC indicates this has not been observed in active exploitation at time of analysis. A notable discrepancy exists: the 'Information Disclosure' tag in the input conflicts with the CVSS 4.0 VC:N (no confidentiality impact to the vulnerable system) - whether data exposure is a realistic secondary outcome should be confirmed against the Johnson Controls vendor advisory. Overall, real-world risk is moderate, primarily relevant to facilities with weak physical security controls around deployed T2000 hardware rather than internet-exposed environments.

An attacker with physical access - such as an authorized contractor, a social-engineered insider, or a physical intruder who bypasses building security - connects directly to the T2000's exposed debug or test interface port and issues commands that are not subject to normal ACL enforcement. This could disable the controller, disrupting HVAC or facility management functions, or allow limited modification of device state. No public exploit code is known, so exploitation currently requires knowledge of the debug interface protocol and physical hardware access.