Johnson Controls vulnerabilities
113 CVEs and advisories name Johnson Controls as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-34490XAAP Android Data Stored in Unencrypted Database
- CVE-2026-34496victor Web - Priviledge Escalation
- CVE-2026-21653CCure and Victor Application Server - Server Side Request Forgery
- CVE-2026-21655C-CURE 9000 and Victor application server - Deserialization of Untrusted Data
- CVE-2026-21661AC2000 Uncontrolled Search Path Element
- CVE-2026-21660Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
- CVE-2026-21659Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion
- CVE-2026-21658Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21657Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21656Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2026-21654Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- CVE-2025-26385Metasys product command injection vulnerability could allow remote SQL execution
- CVE-2025-26386Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool
- CVE-2025-43876iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
- CVE-2025-43875iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo
- CVE-2025-61740Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
- CVE-2025-26379Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator
- CVE-2025-61739Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
- CVE-2025-61738Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
- CVE-2025-26381OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)
- CVE-2025-61736iSTAR- Improper Validation of Certificate Expiration
- CVE-2025-53696iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware.
- CVE-2025-53695OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' us
- CVE-2025-26383The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows
- CVE-2025-26382Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool
- CVE-2024-32862exacqVision CORS
- CVE-2024-32758exacqVision - Key exchanges
- CVE-2024-32931exacqVison - Token Disclosed in URL
- CVE-2024-32865exacqVison - TLS certificate validation
- CVE-2024-32864exacqVison - HTTPS Session Establishment