CISA warns of hardcoded-credential flaw in Johnson Controls TL280 devices
CISA said Johnson Controls TL280 devices running firmware before 5.63 are affected by a vulnerability that could expose sensitive information on the device.
CISA on Aug. 6 published an advisory on Johnson Controls Inc. TL280 devices, warning that versions earlier than 5.63 are affected by CVE-2026-27871 and that a successful exploit could let an attacker access sensitive information on the device.
CISA said the devices are used in industrial and commercial settings, including Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy. The agency said the product is deployed worldwide.
Context and background
CISA identified the vulnerability as involving hardcoded credentials, which the agency described as usernames, passwords or other authentication information embedded directly into firmware source code. CISA also classified the issue under CWE-327, Use of a Broken or Risky Cryptographic Algorithm.
The advisory gave the flaw a CVSS v3.1 base score of 4.1, or medium, with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L. It also assigned a CVSS v4.0 base score of 2.1, or low, with the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N.
CISA said the vendor is Johnson Controls Inc. and listed the company headquarters location as Ireland. The agency also said the report came from Z of VulnCheck.
What officials said
CISA said no known public exploitation targeting the vulnerability had been reported to it at the time of the advisory. It also said the flaw has high attack complexity.
The advisory pointed users to Johnson Controls Product Security Advisory JCI-PSA-2026-08 for more detailed mitigation instructions. CISA’s guidance included updating to firmware 5.63, limiting access to trusted management VLANs, monitoring access logs for unusual authentication activity, rotating shared or downstream credentials tied to hard-coded values, segmenting ICS and SCADA systems behind firewalls, using updated VPNs for remote access, minimizing internet exposure, and checking firmware integrity regularly.
What happens next
Operators using affected TL280 devices will need to review whether their installed firmware is earlier than 5.63 and follow the mitigation steps listed by CISA and Johnson Controls.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.