CVE-2025-61740: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

Published Dec 22, 2025

Updated

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

Affected Software

5 affected components

Johnson Controls IQ Panels2

Johnson Controls IQ Panel 2+

Johnson Controls IQHub

Johnson Controls IQPanel 4

Johnson Controls PowerG

Remediation

Information

a. Update IQ Panel 4’s to version 4.6.1/4.6.1i b. Devices that support PowerG+ should use PowerG v53.05 or later. c. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process d. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater

Event History

Dec 22, 2025

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-61740?

CVE-2025-61740 is considered a high-severity vulnerability due to its potential to cause denial-of-service conditions and unauthorized configuration changes.

How do I fix CVE-2025-61740?

To mitigate CVE-2025-61740, ensure that you apply the latest security patches and updates provided by Johnson Controls for affected devices.

What devices are affected by CVE-2025-61740?

CVE-2025-61740 affects various devices including Johnson Controls IQ Panels2, IQ Panel 2+, IQHub, IQPanel 4, and PowerG.

What risks are associated with CVE-2025-61740?

The main risks of CVE-2025-61740 include potential denial-of-service attacks and unauthorized modifications to device configurations.

Is CVE-2025-61740 remotely exploitable?

Yes, CVE-2025-61740 can be remotely exploited if the attacker can send malicious packets to the vulnerable device.