Johnsoncontrols vulnerabilities
We track 13 vulnerabilities in Johnsoncontrols products across 20 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2026.
Latest Johnsoncontrols vulnerabilities
- 9.8 Critical severity
FM Systems Employee: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.
- 9.8 Critical severity
Frick Controls Quantum HD: Insufficiently Protected Credentials
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or s
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full s
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security o
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security o
- 9.8 Critical severity
Frick Controls Quantum HD: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected act
- 8.8 High severity
iSTAR Configuration Utility (ICU): Missing Authentication for Critical Functionality
The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access
- 7.5 High severity
Metasys NAE55/SNE/SNC: Allocation of Resources Without Limits or Throttling
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12
- 9.8 Critical severity
Illustra Pro Gen 4 Dome: Active Debug Code
A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.
- 9.8 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in a Command
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
- 7.5 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
- 8.8 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.