Johnson Controls Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Johnson Controls products.
Products
- exacqVision6 vulnerabilities
- Frick Controls Quantum HD6 vulnerabilities
- Metasys ADS/ADX/OAS server6 vulnerabilities
- American Dynamics Illustra Essentials Gen 44 vulnerabilities
- iSTAR Configuration Utility (ICU)4 vulnerabilities
- Metasys4 vulnerabilities
- exacqVision Web Service3 vulnerabilities
- FM Systems Employee3 vulnerabilities
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG3 vulnerabilities
- iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G22 vulnerabilities
- iSTAR Ultra, iSTAR Ultra SE2 vulnerabilities
- Metasys versions prior to 9.02 vulnerabilities
- OpenBlue Enterprise Manager Data Collector2 vulnerabilities
- Software House C•CURE 90002 vulnerabilities
- System Configuration Tool (SCT)2 vulnerabilities
- American Dynamics victor Video Management System v5.21 vulnerability
- BCPro (BCM)1 vulnerability
- C-CURE 90001 vulnerability
- CCure 90001 vulnerability
- CCure 9000 and victor application server1 vulnerability
- CEM Systems AC20001 vulnerability
- CEVAS1 vulnerability
- C•CURE 90001 vulnerability
- C•CURE Web Client version 2.90 and prior (Note - This does not affect the new web-based C•CURE 9000 client that was introduced in C•CURE 9000 v2.90)1 vulnerability
- Entrapass1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-34497MEDIUM | FMS Employee Vulnerable to HTML InjectionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1. CWE-80Jul 31, 2026 | CVSS4.8v4.0 | EPSS0.234% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34495MEDIUM | FMS Employee vulnerable to XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1. CWE-79Jul 31, 2026 | CVSS4.8v4.0 | EPSS0.234% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21662MEDIUM | FMS Employee Allows Upload of Unrestricted FilesUnrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1. CWE-434Jul 31, 2026 | CVSS4.8v4.0 | EPSS0.504% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34490MEDIUM | XAAP Android Data Stored in Unencrypted DatabaseCleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53. CWE-312Jul 31, 2026 | CVSS4.8v4.0 | EPSS0.103% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34496HIGH | victor Web - Priviledge EscalationCwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1. CWE-269Jul 23, 2026 | CVSS7.1v4.0 | EPSS0.205% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21653HIGH | CCure and Victor Application Server - Server Side Request ForgeryVictor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0. CWE-918Jul 23, 2026 | CVSS7.2v4.0 | EPSS0.229% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21655HIGH | C-CURE 9000 and Victor application server - Deserialization of Untrusted DataDeserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1. CWE-502Jul 23, 2026 | CVSS8.7v4.0 | EPSS0.165% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21660MEDIUM | Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in FirmwareHardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior. | CVSS6.9v4.0 | EPSS0.23% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21659HIGH | Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File InclusionUnauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior. | CVSS8.7v4.0 | EPSS0.909% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21658HIGH | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionUnauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior. CWE-94Feb 27, 2026 | CVSS8.8v4.0 | EPSS0.626% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21657HIGH | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionImproper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior. CWE-94Feb 27, 2026 | CVSS8.8v4.0 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21656HIGH | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionImproper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior. CWE-94Feb 27, 2026 | CVSS8.8v4.0 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21654HIGH | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior. CWE-78Feb 27, 2026 | CVSS8.8v4.0 | EPSS1.51% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26385CRITICAL | Metasys product command injection vulnerability could allow remote SQL executionJohnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects * Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14… CWE-77Jan 30, 2026 | CVSS9.5v4.0 | EPSS1.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26386HIGH | Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) toolJohnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool. CWE-121Jan 28, 2026 | CVSS7.1v4.0 | EPSS0.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-43876HIGH | iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettingsUnder certain circumstances a successful exploitation could result in access to the device. CWE-78Dec 24, 2025 | CVSS8.7v4.0 | EPSS0.258% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-43875HIGH | iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfoUnder certain circumstances a successful exploitation could result in access to the device. CWE-78Dec 24, 2025 | CVSS8.7v4.0 | EPSS0.267% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-61740HIGH | Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation ErrorAuthentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device. CWE-346Dec 22, 2025 | CVSS7.2v4.0 | EPSS0.123% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26379HIGH | Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number GeneratorUse of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets. CWE-338Dec 22, 2025 | CVSS7.2v4.0 | EPSS0.166% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-61739HIGH | Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryptionDue to Nonce reuse, attackers can perform reply attack or decrypt captured packets. CWE-323Dec 22, 2025 | CVSS7.2v4.0 | EPSS0.166% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Johnson Controls PowerG and IQPanel cleartext transmission of sensitive informationUnder certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. CWE-319Dec 22, 2025 | CVSS2.3v4.0 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-26381MEDIUM | OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information. CWE-425Dec 17, 2025 | CVSS6.5v4.0 | EPSS0.273% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-61736HIGH | iSTAR- Improper Validation of Certificate ExpirationSuccessful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires. CWE-298Dec 17, 2025 | CVSS7.1v4.0 | EPSS0.095% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26383MEDIUM | The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on. CWE-457Jun 11, 2025 | CVSS6.3v4.0 | EPSS0.229% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26382CRITICAL | Johnson Controls Software House iSTAR Configuration Utility (ICU) ToolUnder certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue CWE-121Apr 24, 2025 | CVSS9.3v4.0 | EPSS0.542% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |