Johnson Controls
86 CVEs across 82 Johnson Controls products. Browse Johnson Controls vulnerabilities, severities, and proof-of-concept exploits.
Johnson Controls products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64887 | | 2026-08-14 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1. | |
CVE-2026-34492 | | 2026-08-14 | External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1. | |
CVE-2026-27871 | | 2026-08-14 | Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before… | |
CVE-2026-34497 | Medium | 5.4 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-34490 | Medium | 5.5 | 2026-07-31 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compro… |
CVE-2026-21662 | Critical | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Syst… |
CVE-2026-34496 | | 2026-07-23 | Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1. | |
CVE-2026-21655 | | 2026-07-23 | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Serv… | |
CVE-2026-21653 | | 2026-07-23 | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and v… | |
CVE-2026-21660 | Critical | 9.8 | 2026-02-27 | Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22… |
CVE-2026-21659 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD … |
CVE-2026-21658 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD… |
CVE-2026-21657 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-21656 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-21654 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows O… |
CVE-2025-26385 | | 2026-01-30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Success… | |
CVE-2025-26386 | | 2026-01-28 | Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version… | |
CVE-2025-43876 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-43875 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-61740 | | 2025-12-22 | Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configurat… | |
CVE-2025-26379 | | 2025-12-22 | Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets. | |
CVE-2025-61739 | | 2025-12-22 | Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets. | |
CVE-2025-61738 | | 2025-12-22 | Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. | |
CVE-2025-26381 | | 2025-12-17 | Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information. | |
CVE-2025-61736 | | 2025-12-17 | Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires. | |
CVE-2025-26383 | | 2025-06-11 | The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is run… | |
CVE-2025-26382 | | 2025-04-24 | Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue | |
CVE-2024-32931 | Medium | 5.7 | 2024-08-01 | Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. |
CVE-2024-32865 | Medium | 6.4 | 2024-08-01 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. |
CVE-2024-32862 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. |
CVE-2024-32758 | High | 7.5 | 2024-08-01 | Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange |
CVE-2024-32864 | Medium | 6.4 | 2024-08-01 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) |
CVE-2024-32863 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) |
CVE-2024-32861 | High | 7.8 | 2024-07-16 | Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions. |
CVE-2024-32753 | | 2024-07-11 | Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component | |
CVE-2024-32759 | | 2024-07-10 | Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials. | |
CVE-2024-32754 | Low | 3.1 | 2024-07-04 | Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firm… |
CVE-2024-32932 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the web interface users credentials may be recovered by an authenticated user. |
CVE-2024-32757 | Medium | 6.8 | 2024-07-02 | Under certain circumstances unnecessary user details are provided within system logs |
CVE-2024-32756 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the Linux users credentials may be recovered by an authenticated user. |
CVE-2024-32755 | Critical | 9.1 | 2024-07-02 | Under certain circumstances the web interface will accept characters unrelated to the expected input. |
CVE-2024-32752 | Critical | 9.1 | 2024-06-06 | The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain… |
CVE-2024-0912 | Medium | 4.2 | 2024-06-06 | Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential deta… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-4804 | Critical | 10.0 | 2023-11-10 | An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. |
CVE-2023-3548 | High | 8.3 | 2023-07-25 | An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack. |
CVE-2023-2025 | Medium | 5.0 | 2023-05-18 | OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances. |
CVE-2023-2024 | Critical | 10.0 | 2023-05-18 | Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstanc… |
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2021-36204 | High | 7.8 | 2023-01-13 | Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versi… |
CVE-2021-36206 | Critical | 10.0 | 2022-10-28 | All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data w… |
CVE-2021-36201 | Medium | 4.3 | 2022-10-11 | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
CVE-2022-21941 | Critical | 10.0 | 2022-08-31 | All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the syste… |
CVE-2021-36200 | Medium | 5.3 | 2022-07-22 | Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 1… |
CVE-2022-21938 | High | 8.1 | 2022-06-15 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow… |
CVE-2022-21937 | High | 8.7 | 2022-06-15 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow… |
CVE-2022-21935 | High | 7.5 | 2022-06-15 | A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. |
CVE-2022-21934 | High | 8.0 | 2022-05-06 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 version… |
CVE-2021-36207 | High | 8.8 | 2022-04-29 | Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their… |
CVE-2021-36205 | High | 8.1 | 2022-04-15 | Under certain circumstances the session token is not cleared on logout. |
CVE-2021-36202 | High | 8.4 | 2022-04-07 | Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF ex… |
CVE-2021-36199 | Medium | 5.3 | 2022-01-14 | Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop. |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2021-27665 | High | 7.5 | 2021-10-11 | An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-… |
CVE-2021-27664 | Critical | 9.8 | 2021-10-11 | Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server. |
CVE-2021-27662 | High | 8.6 | 2021-09-15 | The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson… |
CVE-2021-27663 | High | 8.2 | 2021-08-30 | A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authoriz… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-27660 | High | 8.8 | 2021-07-01 | An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. |
CVE-2021-27659 | Medium | 5.3 | 2021-06-24 | exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used… |
CVE-2021-27658 | Medium | 4.3 | 2021-06-24 | exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that i… |
CVE-2021-27657 | High | 8.8 | 2021-06-04 | Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them t… |
CVE-2021-27656 | Medium | 5.3 | 2021-03-18 | A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision W… |
CVE-2020-9050 | High | 7.5 | 2021-02-19 | Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download a… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2020-9048 | High | 7.1 | 2020-10-08 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker… |
CVE-2020-9047 | Medium | 6.8 | 2020-06-26 | A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20… |
CVE-2020-9046 | High | 8.8 | 2020-05-26 | A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by… |
CVE-2020-9045 | Critical | 9.9 | 2020-05-21 | During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2019-7589 | Critical | 9.8 | 2020-03-10 | A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the ser… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-7593 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management… |
CVE-2018-10624 | Medium | 6.5 | 2018-08-01 | In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling… |