CVE-2025-26381 is a medium severity vulnerability in Johnson Controls OpenBlue Workplace (formerly FM Systems) involving CWE-425 Direct Request ('Forced Browsing'). It allows unauthenticated attackers to bypass access controls and gain unauthorized access to sensitive information by directly requesting resources. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 6.5, indicating moderate impact. No known exploits are currently in the wild, and no patches have been published yet. The vulnerability affects version 0 of the product, suggesting early or initial releases. European organizations using OpenBlue Workplace for facility and workplace management could face confidentiality risks if exploited. Mitigation should focus on strict access control enforcement, monitoring for unusual direct resource requests, and applying vendor patches once available. Countries with significant deployments of Johnson Controls products and large commercial real estate sectors, such as Germany, France, and the UK, are most likely to be affected.
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
CVE-2023-4804 is a critical vulnerability in Johnson Controls Quantum HD Unity Compressor products where unauthorized users can access active debug features that were unintentionally exposed. This flaw allows remote attackers to gain full control over the affected devices without any authentication or user interaction. Exploitation can lead to complete compromise of confidentiality, integrity, and availability of the system. The vulnerability has a CVSS score of 10.0, indicating maximum severity. No known exploits are currently reported in the wild, but the risk remains high due to ease of exploitation and critical impact. European organizations using these HVAC control systems could face operational disruptions and data breaches. Immediate mitigation involves restricting network access to these devices, applying vendor patches once available, and monitoring for unusual activity. Countries with significant deployments of Johnson Controls products and critical infrastructure relying on HVAC systems are at higher risk. Given the critical nature and potential for widespread impact, this vulnerability demands urgent attention from defenders.
