# cve.now: Johnson Controls

The newest entries naming Johnson Controls as an affected vendor (up to 200), of 113 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-106019](https://cve.now/CVE-2026-106019.md): Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating… (CVSS 8.8)
- [CVE-2026-64894](https://cve.now/CVE-2026-64894.md): Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows… (CVSS 7.3)
- [CVE-2026-106022](https://cve.now/CVE-2026-106022.md): Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows… (CVSS 8.6)
- [CVE-2026-106020](https://cve.now/CVE-2026-106020.md): Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows… (CVSS 8.6)
- [CVE-2026-71450](https://cve.now/CVE-2026-71450.md): Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows… (CVSS 8.7)
- [CVE-2026-71456](https://cve.now/CVE-2026-71456.md): Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. (CVSS 8.5)
- [CVE-2026-71455](https://cve.now/CVE-2026-71455.md): Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded… (CVSS 5.3)
- [CVE-2026-34499](https://cve.now/CVE-2026-34499.md): Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. (CVSS 8.5)
- [CVE-2026-34498](https://cve.now/CVE-2026-34498.md): L4L (CVSS 5.1)
- [CVE-2026-27873](https://cve.now/CVE-2026-27873.md): - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. (CVSS 5.6)
- [CVE-2026-64893](https://cve.now/CVE-2026-64893.md): - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. (CVSS 7.3)
- [CVE-2026-64892](https://cve.now/CVE-2026-64892.md): - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. (CVSS 6.3)
- [CVE-2026-34494](https://cve.now/CVE-2026-34494.md): - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. (CVSS 7.2)
- [CVE-2026-34493](https://cve.now/CVE-2026-34493.md): - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. (CVSS 7.2)
- [CVE-2026-71449](https://cve.now/CVE-2026-71449.md): : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. (CVSS 9.3)
- [CVE-2026-71448](https://cve.now/CVE-2026-71448.md): : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. (CVSS 5.6)
- [CVE-2026-71453](https://cve.now/CVE-2026-71453.md): - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. (CVSS 5.6)
- [CVE-2026-71452](https://cve.now/CVE-2026-71452.md): - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. (CVSS 7.2)
- [CVE-2026-71451](https://cve.now/CVE-2026-71451.md): - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. (CVSS 5.6)
- [CVE-2026-27874](https://cve.now/CVE-2026-27874.md): : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. (CVSS 5.0)
- [CVE-2026-27872](https://cve.now/CVE-2026-27872.md): EasyIO FG (CVSS 5.6)
- [CVE-2026-64896](https://cve.now/CVE-2026-64896.md): T2000 open debug port (CVSS 5.2)
- [CVE-2026-34491](https://cve.now/CVE-2026-34491.md): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnso (CVSS 6.1)
- [CVE-2026-27875](https://cve.now/CVE-2026-27875.md): Simplex Incident Manager Clear Test (CVSS 6.9)
- [CVE-2026-34492](https://cve.now/CVE-2026-34492.md): Airwall - Arbitrary file read (CVSS 7.0)
- [CVE-2026-64887](https://cve.now/CVE-2026-64887.md): Airwall - Hardcoded Secrets (CVSS 7.0)
- [CVE-2026-27871](https://cve.now/CVE-2026-27871.md): TL280 (CVSS 2.9)
- [CVE-2026-34497](https://cve.now/CVE-2026-34497.md): FMS Employee Vulnerable to HTML Injection (CVSS 4.8)
- [CVE-2026-34495](https://cve.now/CVE-2026-34495.md): FMS Employee vulnerable to XSS (CVSS 4.8)
- [CVE-2026-21662](https://cve.now/CVE-2026-21662.md): FMS Employee Allows Upload of Unrestricted Files (CVSS 4.8)
- [CVE-2026-34490](https://cve.now/CVE-2026-34490.md): XAAP Android Data Stored in Unencrypted Database (CVSS 4.8)
- [CVE-2026-34496](https://cve.now/CVE-2026-34496.md): victor Web - Priviledge Escalation (CVSS 7.1)
- [CVE-2026-21653](https://cve.now/CVE-2026-21653.md): CCure and Victor Application Server - Server Side Request Forgery (CVSS 7.2)
- [CVE-2026-21655](https://cve.now/CVE-2026-21655.md): C-CURE 9000 and Victor application server - Deserialization of Untrusted Data (CVSS 8.7)
- [CVE-2026-21661](https://cve.now/CVE-2026-21661.md): AC2000 Uncontrolled Search Path Element (CVSS 8.4)
- [CVE-2026-21660](https://cve.now/CVE-2026-21660.md): Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware (CVSS 6.9)
- [CVE-2026-21659](https://cve.now/CVE-2026-21659.md): Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (CVSS 8.7)
- [CVE-2026-21658](https://cve.now/CVE-2026-21658.md): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (CVSS 8.8)
- [CVE-2026-21657](https://cve.now/CVE-2026-21657.md): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (CVSS 8.8)
- [CVE-2026-21656](https://cve.now/CVE-2026-21656.md): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (CVSS 8.8)
- [CVE-2026-21654](https://cve.now/CVE-2026-21654.md): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (CVSS 8.8)
- [CVE-2025-26385](https://cve.now/CVE-2025-26385.md): Metasys product command injection vulnerability could allow remote SQL execution (CVSS 9.5)
- [CVE-2025-26386](https://cve.now/CVE-2025-26386.md): Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool (CVSS 7.1)
- [CVE-2025-43876](https://cve.now/CVE-2025-43876.md): iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings (CVSS 8.7)
- [CVE-2025-43875](https://cve.now/CVE-2025-43875.md): iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo (CVSS 8.7)
- [CVE-2025-61740](https://cve.now/CVE-2025-61740.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error (CVSS 7.2)
- [CVE-2025-26379](https://cve.now/CVE-2025-26379.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator (CVSS 7.2)
- [CVE-2025-61739](https://cve.now/CVE-2025-61739.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption (CVSS 7.2)
- [CVE-2025-61738](https://cve.now/CVE-2025-61738.md): Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information (CVSS 2.3)
- [CVE-2025-26381](https://cve.now/CVE-2025-26381.md): OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems) (CVSS 6.5)
- [CVE-2025-61736](https://cve.now/CVE-2025-61736.md): iSTAR- Improper Validation of Certificate Expiration (CVSS 7.1)
- [CVE-2025-53696](https://cve.now/CVE-2025-53696.md): iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. (CVSS 9.3)
- [CVE-2025-53695](https://cve.now/CVE-2025-53695.md): OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' us (CVSS 9.4)
- [CVE-2025-26383](https://cve.now/CVE-2025-26383.md): The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows (CVSS 6.3)
- [CVE-2025-26382](https://cve.now/CVE-2025-26382.md): Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool (CVSS 9.3)
- [CVE-2024-32862](https://cve.now/CVE-2024-32862.md): exacqVision CORS (CVSS 6.8)
- [CVE-2024-32758](https://cve.now/CVE-2024-32758.md): exacqVision - Key exchanges (CVSS 9.0)
- [CVE-2024-32931](https://cve.now/CVE-2024-32931.md): exacqVison - Token Disclosed in URL (CVSS 5.7)
- [CVE-2024-32865](https://cve.now/CVE-2024-32865.md): exacqVison - TLS certificate validation (CVSS 6.4)
- [CVE-2024-32864](https://cve.now/CVE-2024-32864.md): exacqVison - HTTPS Session Establishment (CVSS 6.4)
- [CVE-2024-32863](https://cve.now/CVE-2024-32863.md): exacqVison - CSRF issues with Web Service (CVSS 6.8)
- [CVE-2024-32861](https://cve.now/CVE-2024-32861.md): Software House C•CURE - CouchDB executable protection (CVSS 7.8)
- [CVE-2024-32753](https://cve.now/CVE-2024-32753.md): TYCO Illustra Pro Gen 4 - JQuery version (CVSS 7.0)
- [CVE-2024-32759](https://cve.now/CVE-2024-32759.md): Johnson Controls Software House C●CURE 9000 installer password strength (CVSS 7.7)
- [CVE-2024-32754](https://cve.now/CVE-2024-32754.md): Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information (CVSS 3.1)
- [CVE-2024-32932](https://cve.now/CVE-2024-32932.md): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface (CVSS 6.8)
- [CVE-2024-32757](https://cve.now/CVE-2024-32757.md): American Dynamics Illustra Essentials Gen 4 - Linux Credential Leak (CVSS 6.8)
- [CVE-2024-32756](https://cve.now/CVE-2024-32756.md): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux (CVSS 6.8)
- [CVE-2024-32755](https://cve.now/CVE-2024-32755.md): American Dynamics Illustra Essentials Gen 4 - Log Filter Input Validation (CVSS 9.1)
- [CVE-2024-32752](https://cve.now/CVE-2024-32752.md): Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool (CVSS 8.8)
- [CVE-2024-0912](https://cve.now/CVE-2024-0912.md): CCURE passwords exposed to administrators (CVSS 8.5)
- [CVE-2023-4486](https://cve.now/CVE-2023-4486.md): Uncontrolled Resource Consumption in Metasys and Facility Explorer (CVSS 7.5)
- [CVE-2023-4804](https://cve.now/CVE-2023-4804.md): Quantum HD Unity (CVSS 10.0)
- [CVE-2023-3548](https://cve.now/CVE-2023-3548.md): IQ Wifi 6 (CVSS 8.3)
- [CVE-2023-2025](https://cve.now/CVE-2023-2025.md): Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector (CVSS 5.0)
- [CVE-2023-2024](https://cve.now/CVE-2023-2024.md): Improper Authentication for OpenBlue Enterprise Manager Data Collector (CVSS 10.0)
- [CVE-2022-21940](https://cve.now/CVE-2022-21940.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) (CVSS 7.5)
- [CVE-2022-21939](https://cve.now/CVE-2022-21939.md): Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) (CVSS 7.5)
- [CVE-2021-36204](https://cve.now/CVE-2021-36204.md): Insufficiently Protected Credentials in Metasys (CVSS 7.8)
- [CVE-2021-36206](https://cve.now/CVE-2021-36206.md): CEVAS (CVSS 10.0)
- [CVE-2021-36201](https://cve.now/CVE-2021-36201.md): CCURE Observable Response Discrepancy (CVSS 4.3)
- [CVE-2022-21941](https://cve.now/CVE-2022-21941.md): iSTAR Ultra (CVSS 10.0)
- [CVE-2021-36200](https://cve.now/CVE-2021-36200.md): Metasys ADS/ADX/OAS with MUI (CVSS 5.3)
- [CVE-2022-21938](https://cve.now/CVE-2022-21938.md): Metasys MUI Graphics XSS (CVSS 8.1)
- [CVE-2022-21935](https://cve.now/CVE-2022-21935.md): Metasys password guessing (CVSS 7.5)
- [CVE-2022-21937](https://cve.now/CVE-2022-21937.md): Metasys CSS (CVSS 8.7)
- [CVE-2022-21934](https://cve.now/CVE-2022-21934.md): Metasys Unverified Password Change (CVSS 8.0)
- [CVE-2021-36207](https://cve.now/CVE-2021-36207.md): Metasys privilege management (CVSS 8.8)
- [CVE-2021-36205](https://cve.now/CVE-2021-36205.md): Metasys session token (CVSS 8.1)
- [CVE-2021-36202](https://cve.now/CVE-2021-36202.md): Metasys UI (CVSS 8.4)
- [CVE-2021-36199](https://cve.now/CVE-2021-36199.md): VideoEdge (CVSS 5.3)
- [CVE-2021-36198](https://cve.now/CVE-2021-36198.md): Entrapass (CVSS 8.3)
- [CVE-2021-27665](https://cve.now/CVE-2021-27665.md): exacqVision Server 32-bit (CVSS 7.5)
- [CVE-2021-27664](https://cve.now/CVE-2021-27664.md): exacqVision Web Service (CVSS 9.8)
- [CVE-2021-27662](https://cve.now/CVE-2021-27662.md): KT-1 Capture-replay (CVSS 8.6)
- [CVE-2021-27663](https://cve.now/CVE-2021-27663.md): CEM Systems AC2000 (CVSS 8.2)
- [CVE-2021-27661](https://cve.now/CVE-2021-27661.md): Facility Explorer (CVSS 8.8)
- [CVE-2021-27660](https://cve.now/CVE-2021-27660.md): C-CURE 9000 (CVSS 8.8)
- [CVE-2021-27659](https://cve.now/CVE-2021-27659.md): exacqVision Web Service CSS (CVSS 5.3)
- [CVE-2021-27658](https://cve.now/CVE-2021-27658.md): exacqVision Enterprise Manager CSS (CVSS 4.3)
- [CVE-2021-27657](https://cve.now/CVE-2021-27657.md): Metasys Improper Privilege Management (CVSS 8.8)
- [CVE-2021-27656](https://cve.now/CVE-2021-27656.md): exacqVision Web Services - Information Exposure (CVSS 5.3)
- [CVE-2020-9050](https://cve.now/CVE-2020-9050.md): Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5)
- [CVE-2020-9049](https://cve.now/CVE-2020-9049.md): victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability (CVSS 7.1)
- [CVE-2020-9048](https://cve.now/CVE-2020-9048.md): victor Web Client - Arbitrary File Deletion Vulnerability (CVSS 7.1)
- [CVE-2020-9047](https://cve.now/CVE-2020-9047.md): exacqVision Software - Improper Verification of Cryptographic Signature (CVSS 6.8)
- [CVE-2020-9046](https://cve.now/CVE-2020-9046.md): Kantech EntraPass Security Management Software - System Permissions Vulnerability (CVSS 8.8)
- [CVE-2020-9045](https://cve.now/CVE-2020-9045.md): C•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software. (CVSS 9.9)
- [CVE-2019-7589](https://cve.now/CVE-2019-7589.md): Kantech EntraPass Improper Input Validation (CVSS 9.8)
- [CVE-2020-9044](https://cve.now/CVE-2020-9044.md): Metasys Improper Restriction of XML External Entity Reference (CVSS 7.5)
- [CVE-2019-7594](https://cve.now/CVE-2019-7594.md): Metasys use of hardcoded RC2 key (CVSS 6.8)
- [CVE-2019-7593](https://cve.now/CVE-2019-7593.md): Metasys use of shared RSA key pairs (CVSS 6.8)
- [CVE-2018-10624](https://cve.now/CVE-2018-10624.md): Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/johnson-controls
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.