PatchSiren cyber security CVE debrief

CVE-2025-61738 Johnson Controls Inc. CVE debrief

CVE-2025-61738 is a medium-severity vulnerability in Johnson Controls PowerG, IQPanel, and IQHub products. Under specific circumstances, sensitive information is transmitted in cleartext, allowing an attacker who can capture network traffic to obtain the PowerG network key and subsequently read or write encrypted packets on the network. The vulnerability was disclosed by CISA on December 16, 2025, with an update published March 5, 2026 that refined the vulnerability description and added mitigation details. Johnson Controls has issued firmware updates and operational guidance to address the exposure.

Vendor: Johnson Controls Inc.
Product: PowerG
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-12-16
Original CVE updated: 2026-03-05
Advisory published: 2025-12-16
Advisory updated: 2026-03-05

Who should care

Organizations deploying Johnson Controls PowerG-enabled security systems, including IQPanel 2, IQPanel 2+, IQPanel 4, and IQHub installations. Security integrators and installers responsible for device enrollment and network configuration. Facilities management teams overseeing physical security infrastructure in commercial, industrial, and residential environments.

Technical summary

The vulnerability exists when sensitive information is transmitted without encryption under specific operational conditions. An attacker positioned to capture network traffic can extract the PowerG network encryption key, enabling unauthorized decryption of network communications and the ability to inject crafted packets. The attack requires network access and specific timing during device enrollment or operation. Remediation involves firmware updates to IQPanel 4 (4.6.1/4.6.1i+) and PowerG+ devices (v53.05+), combined with procedural controls during device pairing to prevent key exposure.

Defensive priority

MEDIUM

Recommended defensive actions

Update IQPanel 4 to firmware version 4.6.1/4.6.1i or later prior to enrolling any devices
For PowerG+ capable devices, ensure PowerG firmware v53.05 or later is installed
During sensor enrollment, enter the PIN code in the PIN Code field on the enrollment screen and restrict physical presence to authorized personnel only
Ensure only trusted devices are permitted on the wireless network
When replacing PowerG devices, consider upgrading end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) to IQ Panel 4 with firmware 4.6.1 or greater
Review Johnson Controls Product Security Advisory JCI-PSA-2025-01 v2 for detailed mitigation instructions

Evidence notes

CISA published initial advisory ICSA-25-350-02 on 2025-12-16; Update A released 2026-03-05 with revised description and expanded mitigation guidance. CVSS 3.1 score 5.3 (MEDIUM).

Official resources

2025-12-16