nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-61739 CVE-2025-61739
HIGH
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
Record summary
CVE-2025-61739 has a selected CVSS score of 7.2 (high).
Description
Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
IQ Panels2, 2+, IQHub, IQPanel 4, PowerGBrowse Johnson Controls / IQ Panels2, 2+, IQHub, IQPanel 4, PowerGDefault status: unaffected | CVE List | IQPanel2 to ≤ 2 | affected |
| IQ Panels 2+ to ≤ 2+ | affected | ||
| IQHub | affected | ||
| IQPanel 4 to ≤ 4.6.0 | affected |
References
3cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02 johnsoncontrols.com
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories