Riskcovery

CVE-2025-26379

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

State
Published
Severity
7.2 High
Published
Dec 22, 2025
Updated
Dec 22, 2025
Reserved
Feb 7, 2025

Read the record on cve.org

Description

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

Scores

CVSSScoreVectorSource
4.07.2 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:Njci

Weaknesses

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

ProductVersions
IQ Panels2, 2+, IQHub, IQPanel 4, PowerGJohnson Controls
  • IQ Panels2 through 2Affected
  • IQ Panel 2+ through 2+Affected
  • IQHubAffected
  • IQPanel 4 through 4.6.0Affected
  • PowerG through 53.02Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.