Johnson Controls
Monthly
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. No active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and automatable exploitation is assessed as unlikely due to the AT:P requirement in the CVSS 4.0 vector.
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. No active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and automatable exploitation is assessed as unlikely due to the AT:P requirement in the CVSS 4.0 vector.
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.