Login Request a demo
JC
Vendor
Johnson Controls
35 products with CVEs on record
54
CVEs
0
On KEV
16
New 30D
Products
EF
EasyIO FS32
Johnson Controls
9.3
7 CVEs0 on KEV7 new
KE
Kantech Entrapass
Johnson Controls
8.5
2 CVEs0 on KEV2 new
AD
ADVMS
Johnson Controls
8.5
1 CVEs0 on KEV1 new
EI
Easy IO FG
Johnson Controls
5.6
1 CVEs0 on KEV1 new
EI
Easy IO Neo
Johnson Controls
6.3
1 CVEs0 on KEV1 new
EF
EasyIO FG
Johnson Controls
5.6
1 CVEs0 on KEV1 new
EN
EasyIO NEO
Johnson Controls
7.3
1 CVEs0 on KEV1 new
IS
Illustra Standard - L4L China
Johnson Controls
5.1
1 CVEs0 on KEV1 new
NS
Neo Series MVP2
Johnson Controls
7.2
1 CVEs0 on KEV1 new
FC
Frick Controls Quantum HD
Johnson Controls
9.8
6 CVEs0 on KEV0 new
FS
FM Systems Employee
Johnson Controls
9.8
3 CVEs0 on KEV0 new
IP
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
Johnson Controls
7.2
3 CVEs0 on KEV0 new
AI
Airwall
Johnson Controls
7.0
2 CVEs0 on KEV0 new
IU
iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2
Johnson Controls
8.7
2 CVEs0 on KEV0 new
IU
iSTAR Ultra, iSTAR Ultra SE
Johnson Controls
8.7
2 CVEs0 on KEV0 new
AC
AC2000
Johnson Controls
8.4
1 CVEs0 on KEV0 new
BB
BCPro (BCM)
Johnson Controls
4.3
1 CVEs0 on KEV0 new
C9
C•CURE 9000
Johnson Controls
5.3
1 CVEs0 on KEV0 new
C9
CCure 9000
Johnson Controls
8.7
1 CVEs0 on KEV0 new
C9
CCure 9000 and victor application server
Johnson Controls
7.2
1 CVEs0 on KEV0 new
CE
CEVAS
Johnson Controls
6.1
1 CVEs0 on KEV0 new
I4
IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
Johnson Controls
2.3
1 CVEs0 on KEV0 new
IC
iSTAR Configuration Utility (ICU)
Johnson Controls
7.1
1 CVEs0 on KEV0 new
II
iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
Johnson Controls
7.1
1 CVEs0 on KEV0 new
ME
Metasys
Johnson Controls
9.5
1 CVEs0 on KEV0 new
M1
Metasys 14
Johnson Controls
6.1
1 CVEs0 on KEV0 new
M1
Metasys 15
Johnson Controls
6.1
1 CVEs0 on KEV0 new
MS
Metasys System
Johnson Controls
4.3
1 CVEs0 on KEV0 new
OW
OpenBlue Workplace (formerly FM Systems)
Johnson Controls
6.5
1 CVEs0 on KEV0 new
SI
Simplex Incident Manager / Autocall Fire Administrator
Johnson Controls
6.9
1 CVEs0 on KEV0 new
T2
T2000
Johnson Controls
5.2
1 CVEs0 on KEV0 new
TL
TL280
Johnson Controls
2.9
1 CVEs0 on KEV0 new
VA
Victor Application Server
Johnson Controls
8.7
1 CVEs0 on KEV0 new
VW
victor Web
Johnson Controls
7.1
1 CVEs0 on KEV0 new
XA
XAAP Application
Johnson Controls
5.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-71456
New
KE
Kantech Entrapass
Johnson Controls
8.5
0%
Oct 26Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack
CVE-2026-71455
New
KE
Kantech Entrapass
Johnson Controls
5.3
0%
Oct 26Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data
CVE-2026-34499
AD
ADVMS
Johnson Controls
8.5
0%
Oct 7Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable
CVE-2026-34498
IS
Illustra Standard - L4L China
Johnson Controls
5.1
1%
Oct 6Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection
CVE-2026-27873
EF
EasyIO FG
Johnson Controls
5.6
0%
Oct 1- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying
CVE-2026-64893
EN
EasyIO NEO
Johnson Controls
7.3
0%
Oct 1- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack
CVE-2026-64892
EI
Easy IO Neo
Johnson Controls
6.3
0%
Oct 1- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations
CVE-2026-34494
NS
Neo Series MVP2
Johnson Controls
7.2
0%
Oct 1- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations
CVE-2026-34493
EF
EasyIO FS32
Johnson Controls
7.2
0%
Oct 1- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations
CVE-2026-71449
EF
EasyIO FS32
Johnson Controls
9.3
0%
Oct 1: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data
CVE-2026-71448
EF
EasyIO FS32
Johnson Controls
5.6
0%
Oct 1: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse
CVE-2026-71453
EF
EasyIO FS32
Johnson Controls
5.6
0%
Oct 1- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack
CVE-2026-71452
EF
EasyIO FS32
Johnson Controls
7.2
1%
Oct 1- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection
CVE-2026-71451
EF
EasyIO FS32
Johnson Controls
5.6
0%
Oct 1- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection
CVE-2026-27874
EF
EasyIO FS32
Johnson Controls
5.0
0%
Oct 1: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials
CVE-2026-27872
EI
Easy IO FG
Johnson Controls
5.6
0%
Oct 1- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force)
CVE-2026-64896
T2
T2000
Johnson Controls
5.2
0%
Aug 27T2000 open debug port
CVE-2026-34491
M1
Metasys 15
Johnson Controls
6.1
0%
Aug 24Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site…
CVE-2026-27875
SI
Simplex Incident Manager / Autocall Fire Administrator
Johnson Controls
6.9
0%
Aug 21Simplex Incident Manager Clear Test
CVE-2026-34492
AI
Airwall
Johnson Controls
7.0
0%
Aug 14Airwall - Arbitrary file read
CVE-2026-64887
AI
Airwall
Johnson Controls
7.0
0%
Aug 14Airwall - Hardcoded Secrets
CVE-2026-27871
TL
TL280
Johnson Controls
2.9
0%
Aug 14Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack
CVE-2026-34497
FS
FM Systems Employee
Johnson Controls
5.4
0%
Jul 31FMS Employee Vulnerable to HTML Injection
CVE-2026-34495
FS
FM Systems Employee
Johnson Controls
5.4
0%
Jul 31FMS Employee vulnerable to XSS
CVE-2026-21662
FS
FM Systems Employee
Johnson Controls
9.8
1%
Jul 31FMS Employee Allows Upload of Unrestricted Files
CVE-2026-34490
XA
XAAP Application
Johnson Controls
5.5
0%
Jul 31XAAP Android Data Stored in Unencrypted Database
CVE-2026-34496
VW
victor Web
Johnson Controls
7.1
0%
Jul 23victor Web - Priviledge Escalation
CVE-2026-21653
C9
CCure 9000 and victor application server
Johnson Controls
7.2
0%
Jul 23CCure and Victor Application Server - Server Side Request Forgery
CVE-2026-21655
C9
CCure 9000
Johnson Controls
8.7
0%
Jul 23C-CURE 9000 and Victor application server - Deserialization of Untrusted Data
CVE-2026-21661
AC
AC2000
Johnson Controls
8.4
0%
May 6AC2000 Uncontrolled Search Path Element
CVE-2026-21660
FC
Frick Controls Quantum HD
Johnson Controls
9.8
0%
Feb 27Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
CVE-2026-21659
FC
Frick Controls Quantum HD
Johnson Controls
9.8
1%
Feb 27Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion
CVE-2026-21658
FC
Frick Controls Quantum HD
Johnson Controls
9.8
1%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21657
FC
Frick Controls Quantum HD
Johnson Controls
9.8
0%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21656
FC
Frick Controls Quantum HD
Johnson Controls
9.8
0%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21654
FC
Frick Controls Quantum HD
Johnson Controls
9.8
2%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2025-26385
ME
Metasys
Johnson Controls
9.5
1%
Jan 30Metasys product command injection vulnerability could allow remote SQL execution
CVE-2025-26386
IC
iSTAR Configuration Utility (ICU)
Johnson Controls
7.1
0%
Jan 28Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool
CVE-2025-43876
IU
iSTAR Ultra, iSTAR Ultra SE
Johnson Controls
8.7
0%
Dec 24iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
CVE-2025-43875
IU
iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2
Johnson Controls
8.7
0%
Dec 24iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo
CVE-2025-61740
IP
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
Johnson Controls
7.2
0%
Dec 22Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
CVE-2025-26379
IP
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
Johnson Controls
7.2
0%
Dec 22Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator
CVE-2025-61739
IP
IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
Johnson Controls
7.2
0%
Dec 22Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
CVE-2025-61738
I4
IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
Johnson Controls
2.3
0%
Dec 22Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information
CVE-2025-26381
OW
OpenBlue Workplace (formerly FM Systems)
Johnson Controls
6.5
0%
Dec 17OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)
CVE-2025-61736
II
iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
Johnson Controls
7.1
0%
Dec 17iSTAR- Improper Validation of Certificate Expiration
CVE-2021-36206
CE
CEVAS
Johnson Controls
6.1
1%
Oct 28All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.
CVE-2021-36201
C9
C•CURE 9000
Johnson Controls
5.3
1%
Oct 11CCURE Observable Response Discrepancy
CVE-2018-10624
MS
Metasys System
Johnson Controls
4.3
1%
Aug 1Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information