Refine your search
9 vulnerabilities found for by Johnson Controls
CVE-2025-43876 (GCVE-0-2025-43876)
Vulnerability from cvelistv5
Published
2025-12-24 15:27
Modified
2025-12-24 16:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
Under certain circumstances a successful exploitation could result in access to the device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | iSTAR Ultra, iSTAR Ultra SE |
Version: 0 < |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-43876",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-24T16:20:37.974061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T16:20:55.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSTAR Ultra, iSTAR Ultra SE",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "6.9.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Johnson Controls reported these vulnerabilities to CISA."
}
],
"datePublic": "2025-12-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnder certain circumstances a successful exploitation \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould result in access to the device.\u003c/span\u003e"
}
],
"value": "Under certain circumstances a successful exploitation could result in access to the device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T15:27:06.898Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cspan style=\"background-color: rgba(5, 21, 36, 0.06);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade iSTAR Ultra, iSTAR Ultra SE to version 6.9.7.CU01 or greater.\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003eUpgrade iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 to version 6.9.3 or greater\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Upgrade iSTAR Ultra, iSTAR Ultra SE to version 6.9.7.CU01 or greater.\n * Upgrade iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 to version 6.9.3 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-43876",
"datePublished": "2025-12-24T15:27:06.898Z",
"dateReserved": "2025-04-17T20:07:25.122Z",
"dateUpdated": "2025-12-24T16:20:55.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43875 (GCVE-0-2025-43875)
Vulnerability from cvelistv5
Published
2025-12-24 15:19
Modified
2025-12-24 16:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
Under certain circumstances a successful exploitation could result in access to the device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | iSTAR Ultra, iSTAR Ultra SE |
Version: 0 < |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-43875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-24T16:21:20.354036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T16:21:31.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSTAR Ultra, iSTAR Ultra SE",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "6.9.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Johnson Controls reported these vulnerabilities to CISA."
}
],
"datePublic": "2025-12-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnder certain circumstances a successful exploitation \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould result in access to the device.\u003c/span\u003e"
}
],
"value": "Under certain circumstances a successful exploitation could result in access to the device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T15:24:12.546Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cspan style=\"background-color: rgba(5, 21, 36, 0.06);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade iSTAR Ultra, iSTAR Ultra SE to version 6.9.7.CU01 or greater.\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003eUpgrade iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 to version 6.9.3 or greater\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Upgrade iSTAR Ultra, iSTAR Ultra SE to version 6.9.7.CU01 or greater.\n * Upgrade iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 to version 6.9.3 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-43875",
"datePublished": "2025-12-24T15:19:19.145Z",
"dateReserved": "2025-04-17T20:07:25.122Z",
"dateUpdated": "2025-12-24T16:21:31.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-61740 (GCVE-0-2025-61740)
Vulnerability from cvelistv5
Published
2025-12-22 14:32
Modified
2025-12-22 16:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | IQ Panels2, 2+, IQHub, IQPanel 4, PowerG |
Version: IQ Panels2 < Version: IQ Panels2+ < Version: IQHub < Version: IQPanel 4 < Version: PowerG < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-61740",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T16:19:54.221428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T16:20:04.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ Panels2, 2+, IQHub, IQPanel 4, PowerG",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "2",
"status": "affected",
"version": "IQ Panels2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2+",
"status": "affected",
"version": "IQ Panels2+",
"versionType": "custom"
},
{
"status": "affected",
"version": "IQHub",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": "IQPanel 4",
"versionType": "custom"
},
{
"lessThanOrEqual": "53.02",
"status": "affected",
"version": "PowerG",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Chambers of NCC group"
},
{
"lang": "en",
"type": "finder",
"value": "Sultan Qasim Khan of NCC group"
}
],
"datePublic": "2025-12-16T14:23:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp;Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.\u003cbr\u003e"
}
],
"value": "Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T14:32:07.619Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\u003cbr\u003eb. Devices that support PowerG+ should use PowerG v53.05 or later. \u003cbr\u003ec. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\u003cbr\u003ed. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\nb. Devices that support PowerG+ should use PowerG v53.05 or later. \nc. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\nd. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-61740",
"datePublished": "2025-12-22T14:32:07.619Z",
"dateReserved": "2025-09-30T15:51:17.096Z",
"dateUpdated": "2025-12-22T16:20:04.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-26379 (GCVE-0-2025-26379)
Vulnerability from cvelistv5
Published
2025-12-22 14:21
Modified
2025-12-22 16:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Summary
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | IQ Panels2, 2+, IQHub, IQPanel 4, PowerG |
Version: IQ Panels2 < Version: IQ Panel 2+ < Version: IQHub < Version: IQPanel 4 < Version: PowerG < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T16:19:13.074335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T16:19:25.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ Panels2, 2+, IQHub, IQPanel 4, PowerG",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "2",
"status": "affected",
"version": "IQ Panels2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2+",
"status": "affected",
"version": "IQ Panel 2+",
"versionType": "custom"
},
{
"status": "affected",
"version": "IQHub",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": "IQPanel 4",
"versionType": "custom"
},
{
"lessThanOrEqual": "53.02",
"status": "affected",
"version": "PowerG",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Chambersof NCC Group"
},
{
"lang": "en",
"type": "finder",
"value": "and Sultan Qasim Khan NCC Group"
}
],
"datePublic": "2025-12-16T14:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.\u003cbr\u003e"
}
],
"value": "Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-59 Session Credential Falsification through Prediction"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T14:21:29.597Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\u003cbr\u003eb. Devices that support PowerG+ should use PowerG v53.05 or later. \u003cbr\u003ec. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\u003cbr\u003ed. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\nb. Devices that support PowerG+ should use PowerG v53.05 or later. \nc. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\nd. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-26379",
"datePublished": "2025-12-22T14:21:29.597Z",
"dateReserved": "2025-02-07T14:15:53.879Z",
"dateUpdated": "2025-12-22T16:19:25.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-61739 (GCVE-0-2025-61739)
Vulnerability from cvelistv5
Published
2025-12-22 10:19
Modified
2025-12-22 13:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-323 - Reusing a Nonce, Key pair in encryption
Summary
Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | IQ Panels2, 2+, IQHub, IQPanel 4, PowerG |
Version: IQPanel2 < Version: IQ Panels 2+ < Version: IQHub < Version: IQPanel 4 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-61739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T13:09:06.933752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T13:09:17.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ Panels2, 2+, IQHub, IQPanel 4, PowerG",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "2",
"status": "affected",
"version": "IQPanel2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2+",
"status": "affected",
"version": "IQ Panels 2+",
"versionType": "custom"
},
{
"status": "affected",
"version": "IQHub",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": "IQPanel 4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Chambers of NCC Group"
},
{
"lang": "en",
"type": "finder",
"value": "Sultan Qasim Khan of NCC Group"
}
],
"datePublic": "2025-12-16T10:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp;Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets."
}
],
"value": "Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-323",
"description": "CWE-323 Reusing a Nonce, Key pair in encryption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T10:19:34.183Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\u003cbr\u003eb. Devices that support PowerG+ should use PowerG v53.05 or later. \u003cbr\u003ec. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\u003cbr\u003ed. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\nb. Devices that support PowerG+ should use PowerG v53.05 or later. \nc. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\nd. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-61739",
"datePublished": "2025-12-22T10:19:34.183Z",
"dateReserved": "2025-09-30T15:51:17.096Z",
"dateUpdated": "2025-12-22T13:09:17.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-61738 (GCVE-0-2025-61738)
Vulnerability from cvelistv5
Published
2025-12-22 10:07
Modified
2025-12-22 14:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Summary
Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG |
Version: IQPanel2 < Version: IQHub < Version: IQPanel2+ < Version: ,IQPanel 4 < Version: PowerG < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-61738",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-22T13:14:58.080040Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T13:18:28.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQPanel2,\tIQHub,IQPanel2+,IQPanel 4,PowerG",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "2",
"status": "affected",
"version": "IQPanel2",
"versionType": "custom"
},
{
"status": "affected",
"version": "IQHub",
"versionType": "custom"
},
{
"lessThanOrEqual": "2+",
"status": "affected",
"version": "IQPanel2+",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": ",IQPanel 4",
"versionType": "custom"
},
{
"lessThanOrEqual": "53.02",
"status": "affected",
"version": "PowerG",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Chambers of NCC Group"
},
{
"lang": "en",
"type": "finder",
"value": "Sultan Qasim Khan of NCC Group"
}
],
"datePublic": "2025-12-16T09:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp;Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network."
}
],
"value": "Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network."
}
],
"impacts": [
{
"capecId": "CAPEC-158",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-158 Sniffing Network Traffic"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-22T14:09:49.340Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
},
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\u003cbr\u003eb. Devices that support PowerG+ should use PowerG v53.05 or later. \u003cbr\u003ec. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\u003cbr\u003ed. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "a. Update IQ Panel 4\u2019s to version 4.6.1/4.6.1i\nb. Devices that support PowerG+ should use PowerG v53.05 or later. \nc. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process\nd. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-61738",
"datePublished": "2025-12-22T10:07:19.789Z",
"dateReserved": "2025-09-30T15:51:17.096Z",
"dateUpdated": "2025-12-22T14:09:49.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-26381 (GCVE-0-2025-26381)
Vulnerability from cvelistv5
Published
2025-12-17 16:13
Modified
2025-12-17 16:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-425 - Direct Request ('Forced Browsing')
Summary
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | OpenBlue Workplace (formerly FM Systems) |
Version: 0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-17T16:45:41.544710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T16:45:49.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBlue Workplace (formerly FM Systems)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThanOrEqual": "2025.1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-12-04T16:12:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSuccessful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.\u003c/span\u003e"
}
],
"value": "Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T16:13:38.069Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-03"
},
{
"url": "https://tyco.widen.net/view/pdf/xmejieec4b/JCI-PSA-2025-05.pdf?t.download=true\u0026u=aiurfs"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eUpgrade to patch level 2025.1.3 or above when available. Note: When this patch is applied, skip the below two steps.\u003c/li\u003e\u003cli\u003eDisable the Mobile Application in Microsoft Internet Information Services (IIS) or Disable the mobile application within Microsoft Internet Information Services (IIS) at the application pool level.\u003c/li\u003e\u003cli\u003eUse the primary OpenBlue Workplace web interface: To complete the tasks you\u0027ve previously accomplished in OpenBlue Workplace Mobile interface, the primary Workplace web interface provides a subset of the Mobile functionality and is available here: [base url]/FMInteract/Default.aspx?DashboardType=Homepage.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "* Upgrade to patch level 2025.1.3 or above when available. Note: When this patch is applied, skip the below two steps.\n * Disable the Mobile Application in Microsoft Internet Information Services (IIS) or Disable the mobile application within Microsoft Internet Information Services (IIS) at the application pool level.\n * Use the primary OpenBlue Workplace web interface: To complete the tasks you\u0027ve previously accomplished in OpenBlue Workplace Mobile interface, the primary Workplace web interface provides a subset of the Mobile functionality and is available here: [base url]/FMInteract/Default.aspx?DashboardType=Homepage."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-26381",
"datePublished": "2025-12-17T16:13:38.069Z",
"dateReserved": "2025-02-07T14:15:53.880Z",
"dateUpdated": "2025-12-17T16:45:49.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-61736 (GCVE-0-2025-61736)
Vulnerability from cvelistv5
Published
2025-12-17 12:36
Modified
2025-12-17 15:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-298 - -Improper Validation of certificate expiration
Summary
Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Johnson Controls | iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE |
Version: iSTAR All versions prior to TLS 1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-61736",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-17T15:07:21.695642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T15:09:46.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "iSTAR All versions prior to TLS 1.2"
}
]
}
],
"datePublic": "2025-12-04T12:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSuccessful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.\u003c/span\u003e"
}
],
"value": "Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94: Adversary in the Middle (AiTM)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-298",
"description": "CWE-298-Improper Validation of certificate expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T12:36:24.178Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-04"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJohnson Controls recommends the following mitigations:\u003c/p\u003e\u003cp\u003eHost-based certificates using TLS 1.2:\u003c/p\u003e\u003cul\u003e\u003cli\u003eQuickest solution\u003c/li\u003e\u003cli\u003eNo Upgrade required to specific C\u2022CURE or iSTAR software/firmware versions\u003c/li\u003e\u003cli\u003eRequires downloading a new certificate to all iSTAR panels simultaneously, resulting in a brief system downtime\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eConvert encryption mode to TLS 1.3, per cluster:\u003c/p\u003e\u003cul\u003e\u003cli\u003eRequires firmware 6.9.0 or higher, and C\u2022CURE 9000 v2.90 SP3 or higher\u003c/li\u003e\u003cli\u003eEnables phased implementation by cluster, minimizing disruption\u003c/li\u003e\u003cli\u003eNote: TLS 1.3 is not supported on iSTAR eX, iSTAR Edge, and iSTAR Ultra LT panels\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eUpgrade legacy panels to new G2 hardware:\u003c/p\u003e\u003cul\u003e\u003cli\u003eRecommended for smaller systems due to time constraints\u003c/li\u003e\u003cli\u003eApplies primarily to iSTAR eX, iSTAR Edge, and iSTAR LT panels\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Johnson Controls recommends the following mitigations:\n\nHost-based certificates using TLS 1.2:\n\n * Quickest solution\n * No Upgrade required to specific C\u2022CURE or iSTAR software/firmware versions\n * Requires downloading a new certificate to all iSTAR panels simultaneously, resulting in a brief system downtime\n\n\nConvert encryption mode to TLS 1.3, per cluster:\n\n * Requires firmware 6.9.0 or higher, and C\u2022CURE 9000 v2.90 SP3 or higher\n * Enables phased implementation by cluster, minimizing disruption\n * Note: TLS 1.3 is not supported on iSTAR eX, iSTAR Edge, and iSTAR Ultra LT panels\n\n\nUpgrade legacy panels to new G2 hardware:\n\n * Recommended for smaller systems due to time constraints\n * Applies primarily to iSTAR eX, iSTAR Edge, and iSTAR LT panels"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "iSTAR- Improper Validation of Certificate Expiration",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2025-61736",
"datePublished": "2025-12-17T12:36:24.178Z",
"dateReserved": "2025-09-30T15:51:17.096Z",
"dateUpdated": "2025-12-17T15:09:46.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-4804 (GCVE-0-2023-4804)
Vulnerability from cvelistv5
Published
2023-11-10 22:17
Modified
2025-12-16 18:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-489 - Active Debug Code
Summary
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Johnson Controls | Quantum HD Unity Compressor |
Version: 0 < 11.22 Version: 0 < 12.22 |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:38:00.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-4804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2023-11-18T05:00:39.237843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:23:26.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity Compressor",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.22",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity AcuAir",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity Condenser/Vessel",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity Evaporator",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity Engine Room",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quantum HD Unity Interface",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "11.11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Jim Reprogle"
}
],
"datePublic": "2023-11-10T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An\u0026nbsp;unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed."
}
],
"value": "An\u00a0unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "CWE-489: Active Debug Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-10T22:17:55.249Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update all Quantum HD Unity Compressor control panels to firmware version 11.22 (Q5) or 12.22 (Q6).\u003cbr\u003e"
}
],
"value": "Update all Quantum HD Unity Compressor control panels to firmware version 11.22 (Q5) or 12.22 (Q6).\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update all Quantum HD Unity AcuAir control panels to firmware version 11.12 (Q5) or 12.12 (Q6).\u003cbr\u003e"
}
],
"value": "Update all Quantum HD Unity AcuAir control panels to firmware version 11.12 (Q5) or 12.12 (Q6).\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update all Quantum HD Unity Condenser/Vessel control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\u003cbr\u003e"
}
],
"value": "Update all Quantum HD Unity Condenser/Vessel control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nUpdate all Quantum HD Unity Evaporator control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\u003cbr\u003e"
}
],
"value": "\nUpdate all Quantum HD Unity Evaporator control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nUpdate all Quantum HD Unity Engine Room control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\u003cbr\u003e"
}
],
"value": "\nUpdate all Quantum HD Unity Engine Room control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nUpdate all Quantum HD Unity Interface control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\u003cbr\u003e"
}
],
"value": "\nUpdate all Quantum HD Unity Interface control panels to firmware version 11.11 (Q5) or 12.11 (Q6).\n\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Quantum HD Unity",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2023-4804",
"datePublished": "2023-11-10T22:17:55.249Z",
"dateReserved": "2023-09-06T15:44:07.459Z",
"dateUpdated": "2025-12-16T18:23:26.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}