CVE Program partner

jci

Johnson Controls

API
CVEs, 365 days46117 all time, 3 rejected
Quality96%median 99%
CVSS by the CNA100%share of records
CWE89%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationJohnson Controls
RoleCNA
TypeVendor
Reports toicscert → CISA
ScopeJohnson Controls products only.
Advisorieshttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Latest CVEs · RSS

  • CVE-2026-34499 2026-10-07 · CVSS 8.5
    Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: bef
  • CVE-2026-34498 2026-10-06 · CVSS 5.1
    Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra S
  • CVE-2026-27873 2026-10-01 · CVSS 5.6
    - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52.
  • CVE-2026-64893 2026-10-01 · CVSS 7.3
    - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO
  • CVE-2026-64892 2026-10-01 · CVSS 6.3
    - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy I
  • CVE-2026-34494 2026-10-01 · CVSS 7.2
    - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series M
  • CVE-2026-34493 2026-10-01 · CVSS 7.2
    - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: bef
  • CVE-2026-71449 2026-10-01 · CVSS 9.3
    : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32:
  • CVE-2026-71448 2026-10-01 · CVSS 5.6
    : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: befo
  • CVE-2026-71454 2026-10-01 · CVSS 5.8
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site S
  • CVE-2026-71453 2026-10-01 · CVSS 5.6
    - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
  • CVE-2026-71452 2026-10-01 · CVSS 7.2
    - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.
  • CVE-2026-71451 2026-10-01 · CVSS 5.6
    - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63.
  • CVE-2026-27874 2026-10-01 · CVSS 5.0
    : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects Ea
  • CVE-2026-27872 2026-10-01 · CVSS 5.6
    - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.
  • CVE-2026-64896 2026-08-27 · CVSS 5.2
    Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.
  • CVE-2026-34491 2026-08-24 · CVSS 6.1
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 1
  • CVE-2026-27875 2026-08-21 · CVSS 6.9
    Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attck
  • CVE-2026-34492 2026-08-14 · CVSS 7.0
    External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1.
  • CVE-2026-64887 2026-08-14 · CVSS 7.0
    Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1.
  • CVE-2026-27871 2026-08-14 · CVSS 2.9
    Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before
  • CVE-2026-34497 2026-07-31 · CVSS 4.8
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting
  • CVE-2026-34495 2026-07-31 · CVSS 4.8
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. T
  • CVE-2026-21662 2026-07-31 · CVSS 4.8
    Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Syste
  • CVE-2026-34490 2026-07-31 · CVSS 4.8
    Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise comprom

All CVE Program partners