Critical Johnson Controls Products Vulnerabilities Enables Remote SQL Injection Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical advisory addressing a severe SQL injection<\/a> vulnerability affecting multiple Johnson Controls industrial control system products.<\/p>\n The vulnerability, tracked as CVE-2025-26385, carries a maximum CVSS v3 severity score of 10.0, indicating the highest level of risk to affected infrastructure.<\/p>\n The flaw stems from improper neutralization<\/a> of special elements used in command injection, allowing remote attackers to execute arbitrary SQL commands without authentication.<\/p>\n Successful exploitation enables attackers to alter, delete, or exfiltrate sensitive data from affected systems.<\/p>\n The vulnerability impacts six Johnson Controls products used across critical infrastructure sectors worldwide. Johnson Controls products are deployed across multiple critical infrastructure sectors.<\/p>\n Including commercial facilities, critical manufacturing, energy generation, government operations, and transportation systems.<\/p>\n The company, headquartered in Ireland, maintains a global presence, making this vulnerability a widespread concern.<\/p>\n CISA recommends organizations implement the following defensive measures to minimize exploitation risk.<\/p>\n Control system networks must be isolated from internet exposure and positioned behind firewalls<\/a>, separated from business network infrastructure.<\/p>\n The vulnerability affects the following Johnson Controls applications:<\/p>\nAffected Products and Scope<\/strong><\/h2>\n