EUVD-2026-51576
GHSA-c9fg-4v92-23wg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges required since device must be pre-compromised (rooted); only partial confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (jci).
CVSS VectorVendor: jci
Lifecycle Timeline
2DescriptionCVE.org
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data.
This issue affects XAAP Application: before 1.53.
AnalysisAI
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
Technical ContextAI
CWE-312 (Cleartext Storage of Sensitive Information) describes a failure to encrypt sensitive data before persisting it to local storage - typically Android shared preferences, SQLite databases, flat files, or application cache directories. On Android, rooted devices allow any process with elevated privileges to traverse the filesystem and read another app's private data directory, bypassing the OS-enforced sandbox. The affected product, identified via CPE cpe:2.3:a:johnson_controls:xaap_application:*:*:*:*:*:*:*:*, is a Johnson Controls mobile application likely used for building automation or physical access control, making the sensitive information in scope potentially high-value operational or credential data.
RemediationAI
Upgrade the XAAP Application to version 1.53 or later, as indicated by the vulnerability description (versions before 1.53 are affected). The vendor advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories should be consulted for the exact patched release and deployment guidance. As a compensating control prior to patching, organizations should enforce mobile device management (MDM) policies that prohibit jailbroken or rooted devices from accessing enterprise applications - note that MDM enforcement can be bypassed by sophisticated attackers with physical device access. Additionally, restricting the XAAP Application to corporate-managed devices with full-disk encryption enabled reduces exposure, though it does not eliminate the underlying cleartext storage flaw. The exact fix version 1.53 is inferred from the description boundary and has not been independently verified from a specific patch advisory.
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today