productsecurity@jci.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS productsecurity@jci.com
03
assessed vulnerabilities (116)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-71456US | —OT elevated | — | ||
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.
This issue affects Kantech Entrapass: before 9.20. | ||||
| CVE-2026-71455US | — | — | ||
Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data.
This issue affects Kantech Entrap… | ||||
| CVE-2026-34499US | —OT elevated | — | ||
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
This issue affects ADVMS: before 3.10. | ||||
| CVE-2026-34498US | — | — | ||
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra Standard - L4L China:… | ||||
| CVE-2026-71454US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS).
Thi… | ||||
| CVE-2026-71453US | — | — | ||
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.
This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-71452US | — | — | ||
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.
This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-71449US | —OT elevated | — | ||
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.
This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-71448US | —OT elevated | — | ||
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse.
This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-64893US | —OT elevated | — | ||
- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.
This issue affects EasyIO NEO: before 3.3b25. | ||||
| CVE-2026-64892US | — | — | ||
- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.
This issue affects Easy IO Neo: before 3.3b63… | ||||
| CVE-2026-34494US | — | — | ||
- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.
This issue affects Neo Series MVP2: before 3.3b63. | ||||
| CVE-2026-34493US | — | — | ||
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.
This issue affects EasyIO FS32: before 3.3b63. | ||||
| CVE-2026-27873US | —OT elevated | — | ||
- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.
This issue affects EasyIO FG: before 2.0b52. | ||||
| CVE-2026-71451US | — | — | ||
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection.
This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-27874US | —OT elevated | — | ||
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.
This issue affects EasyIO FS32: before 3.… | ||||
| CVE-2026-27872US | —OT elevated | — | ||
- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force).
This issue affects Easy IO FG: before 2.0b52. | ||||
| CVE-2026-64896US | — | — | ||
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects T… | ||||
| CVE-2026-34491US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site… | ||||
| CVE-2026-27875US | — | — | ||
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embed… | ||||