PatchSiren cyber security CVE debrief

CVE-2025-61738 Johnson Controls Inc. CVE debrief

CVE-2025-61738 is a medium-severity vulnerability in Johnson Controls PowerG, IQPanel, and IQHub products. Under specific circumstances, sensitive information is transmitted in cleartext, allowing an attacker who can capture network traffic to obtain the PowerG network key and subsequently read or write encrypted packets on the network. The vulnerability was disclosed by CISA on December 16, 2025, with an update published March 5, 2026 that refined the vulnerability description and added mitigation details. Johnson Controls has issued firmware updates and operational guidance to address the exposure.

Vendor: Johnson Controls Inc.
Product: PowerG
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-12-16
Original CVE updated: 2026-03-05
Advisory published: 2025-12-16
Advisory updated: 2026-03-05

Who should care

Organizations deploying Johnson Controls PowerG-enabled security systems, including IQPanel 2, IQPanel 2+, IQPanel 4, and IQHub installations. Security integrators and installers responsible for device enrollment and network configuration. Facilities management teams overseeing physical security infrastructure in commercial, industrial, and residential environments.

Technical summary

The vulnerability exists when sensitive information is transmitted without encryption under specific operational conditions. An attacker positioned to capture network traffic can extract the PowerG network encryption key, enabling unauthorized decryption of network communications and the ability to inject crafted packets. The attack requires network access and specific timing during device enrollment or operation. Remediation involves firmware updates to IQPanel 4 (4.6.1/4.6.1i+) and PowerG+ devices (v53.05+), combined with procedural controls during device pairing to prevent key exposure.

Defensive priority

MEDIUM

Recommended defensive actions

Update IQPanel 4 to firmware version 4.6.1/4.6.1i or later prior to enrolling any devices
For PowerG+ capable devices, ensure PowerG firmware v53.05 or later is installed
During sensor enrollment, enter the PIN code in the PIN Code field on the enrollment screen and restrict physical presence to authorized personnel only
Ensure only trusted devices are permitted on the wireless network
When replacing PowerG devices, consider upgrading end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) to IQ Panel 4 with firmware 4.6.1 or greater
Review Johnson Controls Product Security Advisory JCI-PSA-2025-01 v2 for detailed mitigation instructions

Evidence notes

CISA published initial advisory ICSA-25-350-02 on 2025-12-16; Update A released 2026-03-05 with revised description and expanded mitigation guidance. CVSS 3.1 score 5.3 (MEDIUM).

Sources and references

Verified primary and authoritative sources

CVE-2025-61738 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-61738

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-61738 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61738

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-350-02.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.