Vulnerabilidades de Johnson Controls

CVE-2026-34499 Alta · 8.5 CWE-321 07/10/2026

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read…

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.

CVE-2026-34498 Média · 5.1 CWE-20 06/10/2026

L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394.

CVE-2026-34491 Média · 6.1 CWE-79 24/08/2026

Improper neutralization of input during web page generation ('cross-site scripting')...

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

CVE-2026-27875 Média · 6.9 CWE-316 21/08/2026

Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

CVE-2026-21661 Alta · 8.4 CWE-427 06/05/2026

AC2000 Uncontrolled Search Path Element

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

CVE-2026-21660 Crítica · 9.8 CWE-522 27/02/2026

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21659 Crítica · 9.8 CWE-22 27/02/2026

Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21658 Crítica · 9.8 CWE-94 27/02/2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21657 Crítica · 9.8 CWE-94 27/02/2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21656 Crítica · 9.8 CWE-94 27/02/2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21654 Crítica · 9.8 CWE-78 27/02/2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2025-26385 Crítica · 9.5 CWE-77 30/01/2026

Johnson Controls Metasys - Injeção de Comando em Implantações com SQL Express

Componente(s) Metasys da Johnson Controls listado(s) abaixo apresentam a vulnerabilidade Neutralização Imprópria de Elementos Especiais Usados em um Comando (Injeção de Comando). A exploração bem-sucedida dessa vulnerabilidade poderia permitir a execução remota de SQL. Este problema afeta: - Metasys: Application and Data Server (ADS) instalado com SQL Express implantado como parte da instalação do Metasys 14.1 e anteriores; - Extended Application and Data Server (ADX) instalado com SQL Express implantado como parte da instalação do Metasys 14.1; - LCS8500 ou NAE8500 instalado com SQL Express implantado como parte da instalação do Metasys, versões 12.0 até 14.1; - System Configuration Tool (SCT) instalado com SQL Express implantado como parte da instalação do SCT 17.1 e anteriores; - Controller Configuration Tool (CCT) instalado com SQL Express implantado como parte da instalação do CCT 17.0 e anteriores.

CVE-2025-26386 Alta · 7.1 CWE-121 28/01/2026

Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.

CVE-2025-43876 Alta · 8.7 CWE-78 24/12/2025

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

Under certain circumstances a successful exploitation could result in access to the device.

CVE-2025-43875 Alta · 8.7 CWE-78 24/12/2025

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo

Under certain circumstances a successful exploitation could result in access to the device.

CVE-2025-61740 Alta · 7.2 CWE-346 22/12/2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

CVE-2025-26379 Alta · 7.2 CWE-338 22/12/2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

CVE-2025-61739 Alta · 7.2 CWE-323 22/12/2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.

CVE-2025-61738 Baixa · 2.3 CWE-319 22/12/2025

Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.

CVE-2025-26381 Média · 6.5 CWE-425 17/12/2025

OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.

CVE-2025-61736 Alta · 7.1 CWE-298 17/12/2025

iSTAR- Improper Validation of Certificate Expiration

Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.