https://vulnogram.org/ Most recent CVEs assigned by Johnson Controls (jci). https://vulnogram.org/seaview/icons/jci.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-34499 https://vulnogram.org/CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10. High Wed, 07 Oct 2026 19:36:37 GMT https://vulnogram.org/CVE-2026-34498 https://vulnogram.org/CVE-2026-34498 Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394. Medium Tue, 06 Oct 2026 13:52:54 GMT https://vulnogram.org/CVE-2026-27873 https://vulnogram.org/CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52. Medium Thu, 01 Oct 2026 21:27:33 GMT https://vulnogram.org/CVE-2026-64893 https://vulnogram.org/CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25. High Thu, 01 Oct 2026 21:25:26 GMT https://vulnogram.org/CVE-2026-64892 https://vulnogram.org/CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63. Medium Thu, 01 Oct 2026 21:23:33 GMT https://vulnogram.org/CVE-2026-34494 https://vulnogram.org/CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63. High Network Exploitable Thu, 01 Oct 2026 21:20:55 GMT https://vulnogram.org/CVE-2026-34493 https://vulnogram.org/CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63. High Network Exploitable Thu, 01 Oct 2026 21:18:55 GMT https://vulnogram.org/CVE-2026-71449 https://vulnogram.org/CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63. Critical Network Exploitable Thu, 01 Oct 2026 21:16:57 GMT https://vulnogram.org/CVE-2026-71448 https://vulnogram.org/CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63. Medium Thu, 01 Oct 2026 21:15:22 GMT https://vulnogram.org/CVE-2026-71454 https://vulnogram.org/CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). This issue affects CAPEC-63: before 3.0b63. Medium Thu, 01 Oct 2026 21:13:17 GMT https://vulnogram.org/CVE-2026-71453 https://vulnogram.org/CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63. Medium Thu, 01 Oct 2026 21:10:08 GMT https://vulnogram.org/CVE-2026-71452 https://vulnogram.org/CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63. High Thu, 01 Oct 2026 21:06:20 GMT https://vulnogram.org/CVE-2026-71451 https://vulnogram.org/CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63. Medium Thu, 01 Oct 2026 20:59:35 GMT https://vulnogram.org/CVE-2026-27874 https://vulnogram.org/CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63. Medium Thu, 01 Oct 2026 20:55:59 GMT https://vulnogram.org/CVE-2026-27872 https://vulnogram.org/CVE-2026-27872 - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52. Medium Thu, 01 Oct 2026 18:57:16 GMT https://vulnogram.org/CVE-2026-64896 https://vulnogram.org/CVE-2026-64896 Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6. Medium Thu, 27 Aug 2026 14:42:33 GMT https://vulnogram.org/CVE-2026-34491 https://vulnogram.org/CVE-2026-34491 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: b… Medium Mon, 24 Aug 2026 17:24:25 GMT https://vulnogram.org/CVE-2026-27875 https://vulnogram.org/CVE-2026-27875 Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Auto… Medium Fri, 21 Aug 2026 17:52:49 GMT https://vulnogram.org/CVE-2026-34492 https://vulnogram.org/CVE-2026-34492 External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1. High Network Exploitable Fri, 14 Aug 2026 19:32:25 GMT https://vulnogram.org/CVE-2026-64887 https://vulnogram.org/CVE-2026-64887 Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1. High Fri, 14 Aug 2026 19:28:20 GMT https://vulnogram.org/CVE-2026-27871 https://vulnogram.org/CVE-2026-27871 Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63. Low Network Exploitable Fri, 14 Aug 2026 19:21:46 GMT https://vulnogram.org/CVE-2026-34497 https://vulnogram.org/CVE-2026-34497 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1. Medium Fri, 31 Jul 2026 17:31:05 GMT https://vulnogram.org/CVE-2026-34495 https://vulnogram.org/CVE-2026-34495 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1. Medium Fri, 31 Jul 2026 17:30:52 GMT https://vulnogram.org/CVE-2026-21662 https://vulnogram.org/CVE-2026-21662 Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1. Medium Fri, 31 Jul 2026 17:30:41 GMT https://vulnogram.org/CVE-2026-34490 https://vulnogram.org/CVE-2026-34490 Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53. Medium Fri, 31 Jul 2026 17:17:33 GMT https://vulnogram.org/CVE-2026-34496 https://vulnogram.org/CVE-2026-34496 Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1. High Thu, 23 Jul 2026 20:26:31 GMT https://vulnogram.org/CVE-2026-21653 https://vulnogram.org/CVE-2026-21653 Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0. High Thu, 23 Jul 2026 20:19:32 GMT https://vulnogram.org/CVE-2026-21655 https://vulnogram.org/CVE-2026-21655 Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor… High Thu, 23 Jul 2026 20:13:05 GMT https://vulnogram.org/CVE-2026-21661 https://vulnogram.org/CVE-2026-21661 An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before… High Wed, 06 May 2026 16:21:13 GMT https://vulnogram.org/CVE-2026-21660 https://vulnogram.org/CVE-2026-21660 A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential m… Medium Fri, 27 Feb 2026 09:18:49 GMT https://vulnogram.org/CVE-2026-21659 https://vulnogram.org/CVE-2026-21659 Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading… High Network Exploitable Fri, 27 Feb 2026 09:08:50 GMT https://vulnogram.org/CVE-2026-21658 https://vulnogram.org/CVE-2026-21658 Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit u… High Network Exploitable Fri, 27 Feb 2026 08:59:13 GMT https://vulnogram.org/CVE-2026-21657 https://vulnogram.org/CVE-2026-21657 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the… High Network Exploitable Fri, 27 Feb 2026 08:54:28 GMT https://vulnogram.org/CVE-2026-21656 https://vulnogram.org/CVE-2026-21656 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the… High Network Exploitable Fri, 27 Feb 2026 08:47:21 GMT https://vulnogram.org/CVE-2026-21654 https://vulnogram.org/CVE-2026-21654 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unex… High Network Exploitable Fri, 27 Feb 2026 08:38:42 GMT https://vulnogram.org/CVE-2025-26385 https://vulnogram.org/CVE-2025-26385 Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects *… Critical Network Exploitable Fri, 30 Jan 2026 11:05:16 GMT https://vulnogram.org/CVE-2025-26386 https://vulnogram.org/CVE-2025-26386 Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure with… High Network Exploitable Wed, 28 Jan 2026 11:24:46 GMT https://vulnogram.org/CVE-2025-43876 https://vulnogram.org/CVE-2025-43876 Under certain circumstances a successful exploitation could result in access to the device. High Wed, 24 Dec 2025 15:27:06 GMT https://vulnogram.org/CVE-2025-43875 https://vulnogram.org/CVE-2025-43875 Under certain circumstances a successful exploitation could result in access to the device. High Wed, 24 Dec 2025 15:19:19 GMT https://vulnogram.org/CVE-2025-61740 https://vulnogram.org/CVE-2025-61740 Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device. High Mon, 22 Dec 2025 14:32:07 GMT https://vulnogram.org/CVE-2025-26379 https://vulnogram.org/CVE-2025-26379 Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets. High Mon, 22 Dec 2025 14:21:29 GMT https://vulnogram.org/CVE-2025-61739 https://vulnogram.org/CVE-2025-61739 Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets. High Mon, 22 Dec 2025 10:19:34 GMT https://vulnogram.org/CVE-2025-61738 https://vulnogram.org/CVE-2025-61738 Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. Low Network Exploitable Mon, 22 Dec 2025 10:07:19 GMT https://vulnogram.org/CVE-2025-26381 https://vulnogram.org/CVE-2025-26381 Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information. Medium Network Exploitable Wed, 17 Dec 2025 16:13:38 GMT https://vulnogram.org/CVE-2025-43873 https://vulnogram.org/CVE-2025-43873 Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device. High Wed, 17 Dec 2025 15:53:04 GMT https://vulnogram.org/CVE-2025-61736 https://vulnogram.org/CVE-2025-61736 Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires. High Wed, 17 Dec 2025 12:36:24 GMT https://vulnogram.org/CVE-2025-26383 https://vulnogram.org/CVE-2025-26383 The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on. Medium Wed, 11 Jun 2025 15:36:41 GMT https://vulnogram.org/CVE-2025-26382 https://vulnogram.org/CVE-2025-26382 Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue Critical Network Exploitable Thu, 24 Apr 2025 19:47:33 GMT https://vulnogram.org/CVE-2024-32862 https://vulnogram.org/CVE-2024-32862 Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. Medium Network Exploitable Thu, 01 Aug 2024 21:57:13 GMT https://vulnogram.org/CVE-2024-32758 https://vulnogram.org/CVE-2024-32758 Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange Critical Network Exploitable Thu, 01 Aug 2024 21:50:16 GMT