Johnsoncontrols
6 CVEs across 115 Johnsoncontrols products. Browse Johnsoncontrols vulnerabilities, severities, and proof-of-concept exploits.
Johnsoncontrols products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34497 | Medium | 5.4 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-34490 | Medium | 5.5 | 2026-07-31 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compro… |
CVE-2026-21662 | Critical | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Syst… |
CVE-2026-21661 | | 2026-05-06 | Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue… | |
CVE-2026-21660 | Critical | 9.8 | 2026-02-27 | Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22… |
CVE-2026-21659 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD … |
CVE-2026-21658 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD… |
CVE-2026-21657 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-21656 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-21654 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows O… |
CVE-2024-32931 | Medium | 5.7 | 2024-08-01 | Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. |
CVE-2024-32865 | Medium | 6.4 | 2024-08-01 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. |
CVE-2024-32862 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. |
CVE-2024-32758 | High | 7.5 | 2024-08-01 | Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange |
CVE-2024-32864 | Medium | 6.4 | 2024-08-01 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) |
CVE-2024-32863 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) |
CVE-2024-0912 | Medium | 4.2 | 2024-06-06 | Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential deta… |
CVE-2024-0242 | High | 7.3 | 2024-02-08 | Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings. |
CVE-2023-0248 | High | 7.5 | 2023-12-14 | An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-4804 | Critical | 10.0 | 2023-11-10 | An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. |
CVE-2023-3749 | High | 7.1 | 2023-08-03 | A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation. |
CVE-2023-3548 | High | 8.3 | 2023-07-25 | An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack. |
CVE-2023-3127 | High | 7.5 | 2023-07-11 | An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights. |
CVE-2023-0954 | High | 8.3 | 2023-06-08 | A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained att… |
CVE-2023-2025 | Medium | 5.0 | 2023-05-18 | OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances. |
CVE-2023-2024 | Critical | 10.0 | 2023-05-18 | Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstanc… |
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2021-36204 | High | 7.8 | 2023-01-13 | Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versi… |
CVE-2021-36206 | Critical | 10.0 | 2022-10-28 | All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data w… |
CVE-2021-36201 | Medium | 4.3 | 2022-10-11 | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
CVE-2022-21936 | High | 8.1 | 2022-10-07 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP… |
CVE-2022-21941 | Critical | 10.0 | 2022-08-31 | All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the syste… |
CVE-2021-36200 | Medium | 5.3 | 2022-07-22 | Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 1… |
CVE-2022-21938 | High | 8.1 | 2022-06-15 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow… |
CVE-2022-21937 | High | 8.7 | 2022-06-15 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow… |
CVE-2022-21935 | High | 7.5 | 2022-06-15 | A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. |
CVE-2022-21934 | High | 8.0 | 2022-05-06 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 version… |
CVE-2021-36207 | High | 8.8 | 2022-04-29 | Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their… |
CVE-2021-36203 | Medium | 5.3 | 2022-04-22 | The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. |
CVE-2021-36205 | High | 8.1 | 2022-04-15 | Under certain circumstances the session token is not cleared on logout. |
CVE-2022-26643 | Medium | 5.3 | 2022-04-13 | An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. |
CVE-2021-36202 | High | 8.4 | 2022-04-07 | Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF ex… |
CVE-2021-36199 | Medium | 5.3 | 2022-01-14 | Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop. |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2021-27665 | High | 7.5 | 2021-10-11 | An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-… |
CVE-2021-27664 | Critical | 9.8 | 2021-10-11 | Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server. |
CVE-2021-27662 | High | 8.6 | 2021-09-15 | The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson… |
CVE-2021-27663 | High | 8.2 | 2021-08-30 | A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authoriz… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-27660 | High | 8.8 | 2021-07-01 | An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. |
CVE-2021-27659 | Medium | 5.3 | 2021-06-24 | exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used… |
CVE-2021-27658 | Medium | 4.3 | 2021-06-24 | exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that i… |
CVE-2021-27657 | High | 8.8 | 2021-06-04 | Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them t… |
CVE-2021-27656 | Medium | 5.3 | 2021-03-18 | A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision W… |
CVE-2020-9050 | High | 7.5 | 2021-02-19 | Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download a… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2020-9048 | High | 7.1 | 2020-10-08 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker… |
CVE-2020-9047 | Medium | 6.8 | 2020-06-26 | A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20… |
CVE-2020-9046 | High | 8.8 | 2020-05-26 | A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by… |
CVE-2020-9045 | Critical | 9.9 | 2020-05-21 | During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2019-7589 | Critical | 9.8 | 2020-03-10 | A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the ser… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-7593 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management… |
CVE-2019-7590 | Medium | 6.7 | 2019-07-19 | ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to inser… |
CVE-2018-10624 | Medium | 6.5 | 2018-08-01 | In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling… |
CVE-2014-5428 | | 2015-03-29 | Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), E… | |
CVE-2014-5427 | | 2015-03-29 | Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server… | |
CVE-2012-4026 | | 2012-07-16 | The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 (aka… | |
CVE-2012-2607 | | 2012-07-16 | The Johnson Controls CK721-A controller with firmware before SSM4388_03.1.0.14_BB allows remote attackers to perform arbitrary actions via crafted packets to T… |