Low severity · published Dec 22, 2025
CVE-2025-61738
Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
2.3
CVSS
0.2%
EPSS
No
On KEV
Description
Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I4
IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG · Johnson Controls
IQPanel2 through 2; IQHub; IQPanel2+ through 2+; ,IQPanel 4 through 4.6.0; PowerG through 53.02 · source: vendor
Affected product
I4
IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
Johnson Controls