Johnson Controls
Monthly
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.
Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO (all versions before 3.3b25) lets an attacker who has already achieved a man-in-the-middle position on the network path read data the controller exchanges without encryption. It is rated 7.3 under CVSS 4.0 and mapped to CWE-319, but exploitation is gated rather than trivial: the assessed vector (AV:N/AC:H/PR:L/UI:R, consistent with the CVSS 4.0 AC:H, AT:P, PR:L, UI:P values) requires channel control or interception, low privileges on the attacker side, and a victim-side transmission to occur. There is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate, context-dependent risk rather than an emergency, and impact is primarily confidentiality loss with limited integrity/availability effects.
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
Hard-coded cryptographic key in Johnson Controls EasyIO FS32 building automation controllers before firmware 3.0b63 permits unauthenticated remote retrieval of embedded sensitive data, as the identical key is embedded in firmware and recoverable from any device or firmware image. Network reachability to the controller is required, and because these OT devices are often segmented, practical exploitation may depend on prior access to the building-management network. No public exploit identified at time of analysis, and the vendor has released firmware 3.0b63 to remove the hard-coded key; our independent assessment rates the confidentiality-only impact at CVSS 3.1 7.5 despite the record's CVSS 4.0 score of 9.3.
OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Kantech Entrapass before 9.20 stores embedded sensitive information in cleartext in memory, so an actor with local access, high-level host privileges, and the required user interaction can retrieve that data. The issue is rated CVSS 5.3 and assessed as a moderate, low-urgency information-disclosure risk rather than a remote compromise path, because exploitation depends on pre-existing privileged local access and realistic exposure is confined to insiders or post-compromise situations. Vendor patching is available (upgrade to 9.20 or later); no public exploit identified at time of analysis.
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Password spraying attacks against EasyIO FG controllers running firmware before 2.0b52 can succeed due to hard-coded credentials (CWE-798), enabling unauthenticated remote attackers to bypass authentication and potentially achieve high integrity and availability impact with low confidentiality impact. Affected devices are those with firmware versions prior to 2.0b52, and exploitation requires use of a vendor hard-coded credential and access to the controller's management interface, which may be exposed via BACnet/IP, web, or integration ports. This is a moderate-priority, context-dependent issue rather than an internet-wide emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H.
Information disclosure in Johnson Controls Easy IO Neo versions before 3.3b63 allows an authenticated high-privileged attacker to read sensitive data from predictable common resource locations, but requires passive user interaction and yields low confidentiality impact per the independent assessment. This medium-severity flaw (CVSS 4.0 base 6.3, CWE-200) has no public exploit identified at time of analysis. Exploitation depends on the attacker already holding high-privilege access to the controller and on a victim performing passive user interaction, substantially limiting opportunistic exploitation.
Authentication abuse in Johnson Controls EasyIO FS32 building-automation controllers running firmware earlier than 3.0b63 lets an attacker who already holds privileged access on the adjacent network leverage an insecurely initialized default resource to subvert authentication, with assessed consequences spanning integrity and availability of the controller and knock-on effects at system scope. Exploitation is heavily gated: the attacker must sit on the adjacent/local network (AV:A, not internet-reachable), must already be privileged (PR:H), must clear high attack complexity (AC:H) and a specific attack requirement (AT:P), so this is realistically reachable only by someone with an existing foothold on the building-automation network, not by an unauthenticated remote actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is 5.6 (medium).
Cross-site scripting (CWE-79) in an unidentified Johnson Controls web application component affects builds prior to 3.0b63, allowing an attacker with a low-privileged authenticated session (CVSS PR:L) to submit crafted input into a field that is rendered to other users without proper neutralization. The reported CVSS 4.0 base score is 5.8 (Medium), with scope-change metrics (SC:H/SI:H/SA:H) indicating the impact can extend beyond the vulnerable component into the browser session or downstream consumers of the page. The affected product cannot be pinned down from the source data because the CPE entry resolves to a generic classification label ('CWE-79 - Cross-site Scripting' / 'CAPEC-63') rather than a real product name, so the specific Johnson Controls offering, the vulnerable feature, and whether the flaw is stored or reflected remain unconfirmed; the only vendor reference is the Johnson Controls cybersecurity advisory page. There is no confirmed CISA KEV listing (not confirmed actively exploited (CISA KEV)), but the CVSS 4.0 Exploit Maturity value of Proof-of-Concept (E:P) indicates publicly available exploit code exists, and our independent assessment notes that reliable exploitation depends on a second user rendering the injected content, which limits reliability and scope.
Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 expose a file/path-handling function to externally controlled input (CWE-73), allowing a high-privileged, authenticated attacker with adjacent-network access to supply crafted file names or paths and reach files outside the intended location, with the potential to read sensitive data and to overwrite or corrupt files that affect device integrity and availability. Exploitation is constrained: it requires a foothold on the OT/building-automation network segment (CVSS AV:A), an elevated privileged session on the device (PR:H), a specific attack prerequisite (AT:P), and a high-complexity sequence (AC:H), yielding a base score of 5.6 under CVSS 4.0 and an assessed CVSS 3.1 vector of AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a genuine but non-urgent issue whose practical risk is materially lower than the path-traversal label alone suggests.
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Hard-coded credentials in Johnson Controls EasyIO FS32 firmware before 3.0b63 allow an attacker with adjacent-network access to use embedded login secrets and cause a high availability impact on the controller; the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only availability affected (C:N/I:N/A:H). This is not remotely internet-exploitable, the vendor notes an additional precondition (CVSS 4.0 AT:P), and no public exploit identified at time of analysis, making it a moderate, context-dependent risk. Johnson Controls lists the fix as EasyIO FS32 firmware 3.0b63 and later, with the advisory at its trust center.
Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. No active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and automatable exploitation is assessed as unlikely due to the AT:P requirement in the CVSS 4.0 vector.
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
OS command injection in Johnson Controls devices can allow a low-privilege authenticated remote attacker to execute arbitrary operating-system commands and gain access to the affected device, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability is High severity (CVSS 4.0 8.7) and requires a network path plus valid low-privilege credentials, with exploitation reportedly limited to certain circumstances. No public exploit identified at time of analysis, and no KEV status or EPSS score was provided in the supplied intelligence.
Command injection in certain Johnson Controls devices allows a low-privilege authenticated attacker to execute arbitrary operating system commands, resulting in high impact to confidentiality, integrity, and availability of the device. Exploitation requires network access to an affected interface and valid credentials, but no user interaction; the exact affected models and endpoints are not specified in the available data. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the vague description warrants verification against the vendor and CISA advisories.
Packet-source validation failure in Johnson Controls ICS devices on an adjacent network segment allows unauthenticated attackers to spoof traffic, potentially modifying device configuration or causing denial of service. The flaw is CWE-346 (origin validation error), requires Layer-2 adjacency (AV:A), and needs no user interaction. No public exploit code was identified at time of analysis; EPSS is 0.13% (3rd percentile), and KEV status is not indicated.
Weak pseudo-random number generation in Johnson Controls PowerG encrypted wireless communications allows an unauthenticated attacker within RF range to predict cryptographic material and read or inject PowerG packets, as assessed with high integrity impact (VI:H). The flaw is proximity-bound (CVSS AV:A) and cannot be exploited over the internet, affecting any PowerG-enabled alarm system by default. EPSS is low at 0.19% and no public exploit or CISA KEV entry is identified at time of analysis, but the cryptographic weakness undermines the confidentiality and integrity of alarm signaling.
Nonce reuse in Johnson Controls ICS encrypted communications lets unauthenticated attackers on an adjacent network replay captured packets or decrypt intercepted traffic, with high integrity impact and limited confidentiality and availability impact. The supplied data does not name the exact affected device models or firmware versions, so scope must be confirmed against the Johnson Controls advisory and CISA ICSA-25-350-02. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.19%.
Network key exposure in Johnson Controls PowerG wireless security networks can allow an attacker within radio range to capture the network key under narrow conditions and then read or modify encrypted PowerG packets. This is a low-severity issue (CVSS 2.3; assessed CVSS 3.1 AV:A/AC:H/PR:N/UI:R/C:L/I:L/A:N), with EPSS 0.18% and no public exploit identified at time of analysis. Exploitation requires RF proximity and a specific capture window, so realistic risk is limited despite the unauthenticated vector.
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.
Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO (all versions before 3.3b25) lets an attacker who has already achieved a man-in-the-middle position on the network path read data the controller exchanges without encryption. It is rated 7.3 under CVSS 4.0 and mapped to CWE-319, but exploitation is gated rather than trivial: the assessed vector (AV:N/AC:H/PR:L/UI:R, consistent with the CVSS 4.0 AC:H, AT:P, PR:L, UI:P values) requires channel control or interception, low privileges on the attacker side, and a victim-side transmission to occur. There is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate, context-dependent risk rather than an emergency, and impact is primarily confidentiality loss with limited integrity/availability effects.
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
Hard-coded cryptographic key in Johnson Controls EasyIO FS32 building automation controllers before firmware 3.0b63 permits unauthenticated remote retrieval of embedded sensitive data, as the identical key is embedded in firmware and recoverable from any device or firmware image. Network reachability to the controller is required, and because these OT devices are often segmented, practical exploitation may depend on prior access to the building-management network. No public exploit identified at time of analysis, and the vendor has released firmware 3.0b63 to remove the hard-coded key; our independent assessment rates the confidentiality-only impact at CVSS 3.1 7.5 despite the record's CVSS 4.0 score of 9.3.
OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Kantech Entrapass before 9.20 stores embedded sensitive information in cleartext in memory, so an actor with local access, high-level host privileges, and the required user interaction can retrieve that data. The issue is rated CVSS 5.3 and assessed as a moderate, low-urgency information-disclosure risk rather than a remote compromise path, because exploitation depends on pre-existing privileged local access and realistic exposure is confined to insiders or post-compromise situations. Vendor patching is available (upgrade to 9.20 or later); no public exploit identified at time of analysis.
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Password spraying attacks against EasyIO FG controllers running firmware before 2.0b52 can succeed due to hard-coded credentials (CWE-798), enabling unauthenticated remote attackers to bypass authentication and potentially achieve high integrity and availability impact with low confidentiality impact. Affected devices are those with firmware versions prior to 2.0b52, and exploitation requires use of a vendor hard-coded credential and access to the controller's management interface, which may be exposed via BACnet/IP, web, or integration ports. This is a moderate-priority, context-dependent issue rather than an internet-wide emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H.
Information disclosure in Johnson Controls Easy IO Neo versions before 3.3b63 allows an authenticated high-privileged attacker to read sensitive data from predictable common resource locations, but requires passive user interaction and yields low confidentiality impact per the independent assessment. This medium-severity flaw (CVSS 4.0 base 6.3, CWE-200) has no public exploit identified at time of analysis. Exploitation depends on the attacker already holding high-privilege access to the controller and on a victim performing passive user interaction, substantially limiting opportunistic exploitation.
Authentication abuse in Johnson Controls EasyIO FS32 building-automation controllers running firmware earlier than 3.0b63 lets an attacker who already holds privileged access on the adjacent network leverage an insecurely initialized default resource to subvert authentication, with assessed consequences spanning integrity and availability of the controller and knock-on effects at system scope. Exploitation is heavily gated: the attacker must sit on the adjacent/local network (AV:A, not internet-reachable), must already be privileged (PR:H), must clear high attack complexity (AC:H) and a specific attack requirement (AT:P), so this is realistically reachable only by someone with an existing foothold on the building-automation network, not by an unauthenticated remote actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is 5.6 (medium).
Cross-site scripting (CWE-79) in an unidentified Johnson Controls web application component affects builds prior to 3.0b63, allowing an attacker with a low-privileged authenticated session (CVSS PR:L) to submit crafted input into a field that is rendered to other users without proper neutralization. The reported CVSS 4.0 base score is 5.8 (Medium), with scope-change metrics (SC:H/SI:H/SA:H) indicating the impact can extend beyond the vulnerable component into the browser session or downstream consumers of the page. The affected product cannot be pinned down from the source data because the CPE entry resolves to a generic classification label ('CWE-79 - Cross-site Scripting' / 'CAPEC-63') rather than a real product name, so the specific Johnson Controls offering, the vulnerable feature, and whether the flaw is stored or reflected remain unconfirmed; the only vendor reference is the Johnson Controls cybersecurity advisory page. There is no confirmed CISA KEV listing (not confirmed actively exploited (CISA KEV)), but the CVSS 4.0 Exploit Maturity value of Proof-of-Concept (E:P) indicates publicly available exploit code exists, and our independent assessment notes that reliable exploitation depends on a second user rendering the injected content, which limits reliability and scope.
Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 expose a file/path-handling function to externally controlled input (CWE-73), allowing a high-privileged, authenticated attacker with adjacent-network access to supply crafted file names or paths and reach files outside the intended location, with the potential to read sensitive data and to overwrite or corrupt files that affect device integrity and availability. Exploitation is constrained: it requires a foothold on the OT/building-automation network segment (CVSS AV:A), an elevated privileged session on the device (PR:H), a specific attack prerequisite (AT:P), and a high-complexity sequence (AC:H), yielding a base score of 5.6 under CVSS 4.0 and an assessed CVSS 3.1 vector of AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a genuine but non-urgent issue whose practical risk is materially lower than the path-traversal label alone suggests.
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Hard-coded credentials in Johnson Controls EasyIO FS32 firmware before 3.0b63 allow an attacker with adjacent-network access to use embedded login secrets and cause a high availability impact on the controller; the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only availability affected (C:N/I:N/A:H). This is not remotely internet-exploitable, the vendor notes an additional precondition (CVSS 4.0 AT:P), and no public exploit identified at time of analysis, making it a moderate, context-dependent risk. Johnson Controls lists the fix as EasyIO FS32 firmware 3.0b63 and later, with the advisory at its trust center.
Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. No active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and automatable exploitation is assessed as unlikely due to the AT:P requirement in the CVSS 4.0 vector.
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
OS command injection in Johnson Controls devices can allow a low-privilege authenticated remote attacker to execute arbitrary operating-system commands and gain access to the affected device, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability is High severity (CVSS 4.0 8.7) and requires a network path plus valid low-privilege credentials, with exploitation reportedly limited to certain circumstances. No public exploit identified at time of analysis, and no KEV status or EPSS score was provided in the supplied intelligence.
Command injection in certain Johnson Controls devices allows a low-privilege authenticated attacker to execute arbitrary operating system commands, resulting in high impact to confidentiality, integrity, and availability of the device. Exploitation requires network access to an affected interface and valid credentials, but no user interaction; the exact affected models and endpoints are not specified in the available data. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the vague description warrants verification against the vendor and CISA advisories.
Packet-source validation failure in Johnson Controls ICS devices on an adjacent network segment allows unauthenticated attackers to spoof traffic, potentially modifying device configuration or causing denial of service. The flaw is CWE-346 (origin validation error), requires Layer-2 adjacency (AV:A), and needs no user interaction. No public exploit code was identified at time of analysis; EPSS is 0.13% (3rd percentile), and KEV status is not indicated.
Weak pseudo-random number generation in Johnson Controls PowerG encrypted wireless communications allows an unauthenticated attacker within RF range to predict cryptographic material and read or inject PowerG packets, as assessed with high integrity impact (VI:H). The flaw is proximity-bound (CVSS AV:A) and cannot be exploited over the internet, affecting any PowerG-enabled alarm system by default. EPSS is low at 0.19% and no public exploit or CISA KEV entry is identified at time of analysis, but the cryptographic weakness undermines the confidentiality and integrity of alarm signaling.
Nonce reuse in Johnson Controls ICS encrypted communications lets unauthenticated attackers on an adjacent network replay captured packets or decrypt intercepted traffic, with high integrity impact and limited confidentiality and availability impact. The supplied data does not name the exact affected device models or firmware versions, so scope must be confirmed against the Johnson Controls advisory and CISA ICSA-25-350-02. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.19%.
Network key exposure in Johnson Controls PowerG wireless security networks can allow an attacker within radio range to capture the network key under narrow conditions and then read or modify encrypted PowerG packets. This is a low-severity issue (CVSS 2.3; assessed CVSS 3.1 AV:A/AC:H/PR:N/UI:R/C:L/I:L/A:N), with EPSS 0.18% and no public exploit identified at time of analysis. Exploitation requires RF proximity and a specific capture window, so realistic risk is limited despite the unauthenticated vector.