20251216-cisa.gov-d0d1d | Perceptive Security

< Back to index

Johnson Controls PowerG, IQPanel and IQHub

Published:

16 December 2025 at 12:00:00

Alert date:

16 December 2025 at 18:02:03

Source:

cisa.gov

Mobile & IoT, Critical Infrastructure

Multiple critical vulnerabilities discovered in Johnson Controls PowerG, IQPanel and IQHub security systems affecting worldwide commercial facilities. The vulnerabilities include cleartext transmission of sensitive information, nonce reuse allowing replay attacks, weak pseudo-random number generators, and authentication bypass issues. Attackers can capture network keys, decrypt encrypted packets, perform replay attacks, and modify device configurations. Affects PowerG versions <=53.02, all versions of IQHub, IQPanel 2, IQPanel 2+, and IQPanel 4 versions <4.6.1. Johnson Controls recommends updating to fixed versions and replacing end-of-life products.

Technical details

The vulnerabilities affect Johnson Controls PowerG, IQPanel and IQHub systems used in commercial facilities worldwide. The security issues include: cleartext transmission of sensitive information that allows attackers to capture network keys and read/write encrypted packets (CVE-2025-61738); nonce reuse vulnerability enabling replay attacks or packet decryption (CVE-2025-61739); weak pseudo-random number generator allowing packet injection and reading (CVE-2025-26379); and authentication bypass that doesn't verify packet source, enabling denial-of-service or device configuration modification (CVE-2025-61740). These vulnerabilities could allow attackers to read or write encrypted traffic or perform replay attacks on the PowerG network.

Mitigation steps:

Update IQPanel 4 to version 4.6.1/4.6.1i
Devices that support PowerG+ should use PowerG v53.05 or later
During installation or enrollment phase, enter the PIN code in the PIN Code field on the sensor enrollment screen
Only allow authorized company personnel or integrators to be present during the pairing process
Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater
Minimize network exposure for all control system devices and ensure they are not accessible from the internet
Locate control system networks and remote devices behind firewalls and isolate them from business networks
Use secure methods like VPNs for remote access and keep them updated
Perform proper impact analysis and risk assessment prior to deploying defensive measures

Affected products:

Johnson Controls PowerG (<=53.02)
Johnson Controls IQHub (all versions)
Johnson Controls IQPanel 2 (all versions)
Johnson Controls IQPanel 2+ (all versions)
Johnson Controls IQPanel 4 (<4.6.1)

Related CVE's:

Related threat actors:

IOC's:

This article was created with the assistance of AI technology by Perceptive.