CVE-2025-26379: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PowerGto a version that resolves this vulnerability.Fixed in v53.05 - Upgrade
Upgrade
Johnson Controls IQ Panel 4to a version that resolves this vulnerability.Fixed in 4.6.1 - Configuration
During installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen.
PowerG+ device enrollment PIN Code = Enter the device PIN code - Compensating control
Allow only authorized company personnel or integrators to be present during the pairing process.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26379?
CVE-2025-26379 is considered a high severity vulnerability due to its potential to allow unauthorized access to encrypted PowerG packets.
How do I fix CVE-2025-26379?
To remediate CVE-2025-26379, update your Johnson Controls IQ Panels to the latest firmware version recommended by the vendor.
What types of products are affected by CVE-2025-26379?
CVE-2025-26379 specifically affects Johnson Controls IQ Panels.
What could an attacker do with CVE-2025-26379?
An attacker could exploit CVE-2025-26379 to read or inject data within encrypted PowerG packets.
Is there a workaround for CVE-2025-26379 until a patch is available?
Currently, no specific workarounds are documented for CVE-2025-26379, and applying updates is the recommended course of action.