CVE-2025-26379: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator
Published Dec 22, 2025
·Updated
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
Affected Software
1 affected component
Johnson Controls IQ Panels
Remediation
Information
a. Update IQ Panel 4’s to version 4.6.1/4.6.1i
b. Devices that support PowerG+ should use PowerG v53.05 or later.
c. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process
d. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater
Event History
Dec 22, 2025
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-26379?
CVE-2025-26379 is considered a high severity vulnerability due to its potential to allow unauthorized access to encrypted PowerG packets.
2
How do I fix CVE-2025-26379?
To remediate CVE-2025-26379, update your Johnson Controls IQ Panels to the latest firmware version recommended by the vendor.
3
What types of products are affected by CVE-2025-26379?
CVE-2025-26379 specifically affects Johnson Controls IQ Panels.
4
What could an attacker do with CVE-2025-26379?
An attacker could exploit CVE-2025-26379 to read or inject data within encrypted PowerG packets.
5
Is there a workaround for CVE-2025-26379 until a patch is available?
Currently, no specific workarounds are documented for CVE-2025-26379, and applying updates is the recommended course of action.