Login Request a demo
JO
Vendor
Johnsoncontrols
67 products with CVEs on record
127
CVEs
0
On KEV
0
New 30D
Products
ME
Metasys Extended Application And Data Server
Johnsoncontrols
9.8
11 CVEs0 on KEV0 new
MA
Metasys Application And Data Server
Johnsoncontrols
9.8
10 CVEs0 on KEV0 new
MO
Metasys Open Application Server
Johnsoncontrols
9.8
10 CVEs0 on KEV0 new
EW
Exacqvision Web Service
Johnsoncontrols
9.8
8 CVEs0 on KEV0 new
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
6 CVEs0 on KEV0 new
ES
Exacqvision Server
Johnsoncontrols
7.8
4 CVEs0 on KEV0 new
MS
Metasys System Configuration Tool
Johnsoncontrols
9.1
4 CVEs0 on KEV0 new
C9
C-cure 9000 Firmware
Johnsoncontrols
8.8
3 CVEs0 on KEV0 new
FE
Fms Employee
Johnsoncontrols
9.8
3 CVEs0 on KEV0 new
MS
Metasys System
Johnsoncontrols
9.1
3 CVEs0 on KEV0 new
EE
Exacqvision Enterprise Manager
Johnsoncontrols
7.2
2 CVEs0 on KEV0 new
FF
F4-snc Firmware
Johnsoncontrols
8.8
2 CVEs0 on KEV0 new
IU
Istar Ultra Firmware
Johnsoncontrols
9.8
2 CVEs0 on KEV0 new
KE
Kantech Entrapass
Johnsoncontrols
7.8
2 CVEs0 on KEV0 new
ME
Metsys
Johnsoncontrols
–
2 CVEs0 on KEV0 new
NF
Nae55 Firmware
Johnsoncontrols
9.1
2 CVEs0 on KEV0 new
OE
Openblue Enterprise Manager Data Collector
Johnsoncontrols
7.5
2 CVEs0 on KEV0 new
VI
Videoedge
Johnsoncontrols
5.5
2 CVEs0 on KEV0 new
AF
Ac2000 Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
BC
Bcpro
Johnsoncontrols
4.3
1 CVEs0 on KEV0 new
CW
C-cure Web
Johnsoncontrols
5.3
1 CVEs0 on KEV0 new
CE
Cevas
Johnsoncontrols
6.1
1 CVEs0 on KEV0 new
EC
Easyio Cpt Graphics
Johnsoncontrols
5.3
1 CVEs0 on KEV0 new
EG
Edge G2 Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
EN
Entrapass
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
EC
Exacqvision Client
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
IP
Illustra Pro Gen 4 Dome Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
IP
Illustra Pro Gen 4 Ptz Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
IG
Iosmart Gen 1 Firmware
Johnsoncontrols
5.3
1 CVEs0 on KEV0 new
IW
IQ Wifi 6 Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
IU
Istar Ultra G2 Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
IU
Istar Ultra LT Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
KK
Kantech Kt-1 Door Controller Firmware
Johnsoncontrols
8.1
1 CVEs0 on KEV0 new
ME
Metasys
Johnsoncontrols
8.8
1 CVEs0 on KEV0 new
ML
Metasys Lonworks Control Server
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
MO
Metasys Open Data Server
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
MR
Metasys Reporting Engine
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
NF
Nae85 Firmware
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
NC
Network Controller
Johnsoncontrols
–
1 CVEs0 on KEV0 new
NC
Network Controller Firmware
Johnsoncontrols
–
1 CVEs0 on KEV0 new
NF
Nie55 Firmware
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
NF
Nie59 Firmware
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
NF
Nie85 Firmware
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
OU
Ord-c100-13 Uuklc Firmware
Johnsoncontrols
9.1
1 CVEs0 on KEV0 new
PP
Pegasys P2000 Server
Johnsoncontrols
–
1 CVEs0 on KEV0 new
PP
Pegasys P2000 Server Software
Johnsoncontrols
–
1 CVEs0 on KEV0 new
QI
Qolsys IQ Panel 4 Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QI
Qolsys Iq4 Hub Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Acuair Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Compressor Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Condenser/vessel Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Engine Room Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Evaporator Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
QH
Quantum HD Unity Interface Firmware
Johnsoncontrols
9.8
1 CVEs0 on KEV0 new
SF
Snc16120-0 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
SF
Snc16120-04 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
SF
Snc25150-0 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
SF
Snc25150-04 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
SF
Sne10500 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
SF
Sne11000 Firmware
Johnsoncontrols
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-34497
FE
Fms Employee
Johnsoncontrols
5.4
0%
Jul 31FMS Employee Vulnerable to HTML Injection
CVE-2026-34495
FE
Fms Employee
Johnsoncontrols
5.4
0%
Jul 31FMS Employee vulnerable to XSS
CVE-2026-21662
FE
Fms Employee
Johnsoncontrols
9.8
1%
Jul 31FMS Employee Allows Upload of Unrestricted Files
CVE-2026-34490
XA
Xaap
Johnsoncontrols
5.5
0%
Jul 31XAAP Android Data Stored in Unencrypted Database
CVE-2026-21660
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
0%
Feb 27Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
CVE-2026-21659
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
1%
Feb 27Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion
CVE-2026-21658
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
1%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21657
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
0%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21656
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
0%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2026-21654
FC
Frick Controls Quantum HD Firmware
Johnsoncontrols
9.8
2%
Feb 27Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
CVE-2024-32931
EW
Exacqvision Web Service
Johnsoncontrols
5.7
0%
Aug 1Under certain circumstances the exacqVision Web Service can expose authentication token details within communications
CVE-2024-32865
ES
Exacqvision Server
Johnsoncontrols
7.3
0%
Aug 1Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices
CVE-2024-32862
EW
Exacqvision Web Service
Johnsoncontrols
8.1
0%
Aug 1Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains
CVE-2024-32758
EC
Exacqvision Client
Johnsoncontrols
7.5
0%
Aug 1Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange
CVE-2024-32864
EW
Exacqvision Web Service
Johnsoncontrols
8.1
0%
Aug 1Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)
CVE-2024-32863
EW
Exacqvision Web Service
Johnsoncontrols
8.8
0%
Aug 1Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)
CVE-2024-0912
SH
Software House C-cure 9000 Siteserver
Johnsoncontrols
4.2
0%
Jun 6Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs
CVE-2024-0242
QI
Qolsys IQ Panel 4 Firmware
Johnsoncontrols
9.8
1%
Feb 8Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings
CVE-2023-0248
IG
Iosmart Gen 1 Firmware
Johnsoncontrols
5.3
0%
Dec 14An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication…
CVE-2023-4486
NF
Nae55 Firmware
Johnsoncontrols
7.5
1%
Dec 7Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions…
CVE-2023-4804
QH
Quantum HD Unity Engine Room Firmware
Johnsoncontrols
9.8
1%
Nov 10An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed
CVE-2023-3749
VI
Videoedge
Johnsoncontrols
5.5
0%
Aug 3A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation
CVE-2023-3548
IW
IQ Wifi 6 Firmware
Johnsoncontrols
9.8
1%
Jul 25An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack
CVE-2023-3127
IU
Istar Ultra Firmware
Johnsoncontrols
9.8
1%
Jul 11An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights
CVE-2023-0954
IP
Illustra Pro Gen 4 Ptz Firmware
Johnsoncontrols
9.8
1%
Jun 8A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack
CVE-2023-2025
OE
Openblue Enterprise Manager Data Collector
Johnsoncontrols
6.5
1%
May 18OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances
CVE-2023-2024
OE
Openblue Enterprise Manager Data Collector
Johnsoncontrols
7.5
1%
May 18Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances
CVE-2022-21940
MS
Metasys System Configuration Tool
Johnsoncontrols
6.1
0%
Feb 9Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to…
CVE-2022-21939
MS
Metasys System Configuration Tool
Johnsoncontrols
6.1
1%
Feb 9Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow…
CVE-2021-36204
ME
Metasys Extended Application And Data Server
Johnsoncontrols
7.5
0%
Jan 13Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3…
CVE-2021-36206
CE
Cevas
Johnsoncontrols
6.1
1%
Oct 28All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.
CVE-2021-36201
C9
C-cure 9000 Firmware
Johnsoncontrols
5.3
1%
Oct 11CCURE Observable Response Discrepancy
CVE-2022-21936
ME
Metasys Extended Application And Data Server
Johnsoncontrols
6.5
1%
Oct 7On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.
CVE-2022-21941
IU
Istar Ultra Firmware
Johnsoncontrols
9.8
2%
Aug 31All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system
CVE-2021-36200
ME
Metasys Extended Application And Data Server
Johnsoncontrols
5.3
1%
Jul 22Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate…
CVE-2022-21938
ME
Metasys Extended Application And Data Server
Johnsoncontrols
5.4
1%
Jun 15Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject…
CVE-2022-21937
MO
Metasys Open Application Server
Johnsoncontrols
5.4
1%
Jun 15Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject…
CVE-2022-21935
MO
Metasys Open Application Server
Johnsoncontrols
7.5
1%
Jun 15A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change
CVE-2022-21934
MO
Metasys Open Application Server
Johnsoncontrols
8.8
1%
May 6Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5…
CVE-2021-36207
MA
Metasys Application And Data Server
Johnsoncontrols
8.8
1%
Apr 29Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to…
CVE-2021-36203
MS
Metasys System Configuration Tool
Johnsoncontrols
9.1
1%
Apr 22The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request
CVE-2021-36205
ME
Metasys Extended Application And Data Server
Johnsoncontrols
9.8
1%
Apr 15Under certain circumstances the session token is not cleared on logout
CVE-2022-26643
EC
Easyio Cpt Graphics
Johnsoncontrols
5.3
1%
Apr 13An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application
CVE-2021-36202
ME
Metasys Extended Application And Data Server
Johnsoncontrols
8.8
1%
Apr 7Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature
CVE-2021-36199
VI
Videoedge
Johnsoncontrols
5.3
1%
Jan 14Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop
CVE-2021-36198
KE
Kantech Entrapass
Johnsoncontrols
7.5
1%
Dec 6Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data
CVE-2021-27665
ES
Exacqvision Server
Johnsoncontrols
7.5
2%
Oct 11An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition
CVE-2021-27664
EW
Exacqvision Web Service
Johnsoncontrols
9.8
2%
Oct 11Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server
CVE-2021-27662
KK
Kantech Kt-1 Door Controller Firmware
Johnsoncontrols
8.1
1%
Sep 15The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets
CVE-2021-27663
AF
Ac2000 Firmware
Johnsoncontrols
9.8
2%
Aug 30A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization
CVE-2021-27661
FF
F4-snc Firmware
Johnsoncontrols
8.8
1%
Jul 1Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the…
CVE-2021-27660
C9
C-cure 9000 Firmware
Johnsoncontrols
8.8
2%
Jul 1An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs
CVE-2021-27659
EW
Exacqvision Web Service
Johnsoncontrols
6.1
1%
Jun 24exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that…
CVE-2021-27658
EE
Exacqvision Enterprise Manager
Johnsoncontrols
5.4
1%
Jun 24exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page…
CVE-2021-27657
ME
Metasys
Johnsoncontrols
8.8
1%
Jun 4Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify…
CVE-2021-27656
EW
Exacqvision Web Service
Johnsoncontrols
7.5
1%
Mar 18A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the…
CVE-2020-9050
MR
Metasys Reporting Engine
Johnsoncontrols
7.5
4%
Feb 19Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from…
CVE-2020-9049
CW
C-cure Web
Johnsoncontrols
5.3
1%
Nov 19A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create…
CVE-2020-9048
VW
Victor Web Client
Johnsoncontrols
8.1
1%
Oct 8A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to…
CVE-2020-9047
EE
Exacqvision Enterprise Manager
Johnsoncontrols
7.2
8%
Jun 26A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and…