Johnson Controls vulnerabilities
We track 36 vulnerabilities in Johnson Controls products across 29 products. 36 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Johnson Controls vulnerabilities
- 7.0 High severity
iSTAR Ultra: Missing Protection Mechanism for Alternate Hardware Interface
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑5
- 7.0 High severity
iSTAR Ultra: Missing Protection Mechanism for Alternate Hardware Interface
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.
- 8.4 High severity
iSTAR Ultra: Use of Default Credentials
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials. Thi
- 8.7 High severity
iSTAR Ultra: Improper Neutralization of Special Elements used in an OS Command
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows :
- 8.7 High severity
EasyIO FW: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This issue affects EasyIO FW: through 3.0b25.
- 7.3 High severity
EasyIO Neo IOManager and Tools Installer: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.
- 8.6 High severity
EasyIO Neo IOManager and Tools Installer: Cleartext Storage of Sensitive Information in Memory
Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.
- 8.8 High severity
C-CURE 9000, Victor: Insertion of Sensitive Information into Log File
Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.
- 8.7 High severity
EasyIO Neo EC and CW Edge Controller: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW
- 8.5 High severity
Kantech Entrapass: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.
- 8.5 High severity
ADVMS: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.
- 9.3 Critical severity
EasyIO FS32: Use of Hard-coded Cryptographic Key
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.
- 7.3 High severity
EasyIO NEO: Cleartext Transmission of Sensitive Information
- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.
- 7.2 High severity
Neo Series MVP2: On-Chip Debug and Test Interface With Improper Access Control
- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63.
- 7.2 High severity
EasyIO FS32: On-Chip Debug and Test Interface With Improper Access Control
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63.
- 9.8 Critical severity
FM Systems Employee: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.
- 8.7 High severity
victor: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Applicatio
- 7.2 High severity
CCure 9000 and victor application server: Server-Side Request Forgery
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
- 8.4 High severity
AC2000: Uncontrolled Search Path Element
An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
- 9.8 Critical severity
Frick Controls Quantum HD: Insufficiently Protected Credentials
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or s
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full s
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security o
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security o
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected act
- 9.5 Critical severity
Metasys: Improper Neutralization of Special Elements used in a Command
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects * Metasys:
- 7.1 High severity
iSTAR Configuration Utility (ICU): Stack-based Buffer Overflow
Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the ope
- 7.2 High severity
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG: Origin Validation Error
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
- 9.3 Critical severity
iSTAR Ultra: Download of Code Without Integrity Check
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
- 9.4 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
- 8.8 High severity
iSTAR Configuration Utility (ICU): Missing Authentication for Critical Functionality
The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access
- 7.5 High severity
Metasys NAE55/SNE/SNC: Allocation of Resources Without Limits or Throttling
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12
- 7.5 High severity
OpenBlue Enterprise Manager Data Collector: Improper Authentication
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
- 9.8 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in a Command
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
- 7.5 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
- 8.8 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.