CISA warns of credential-memory flaw in Johnson Controls Simplex Incident Manager
CISA said a flaw in Johnson Controls Simplex Incident Manager could let a local attacker with low privileges extract passwords and tokens from memory. The vendor has released a patched version.
CISA on Aug. 20 published an advisory on a medium-severity vulnerability in Johnson Controls Simplex Incident Manager that could expose credentials stored in memory. The issue is tracked as CVE-2026-27875.
The advisory says a local attacker with low privileges could extract user credentials, including passwords and authentication tokens, from system memory. CISA said the flaw is not remotely exploitable, but it could still lead to unauthorized access to the application and connected systems if abused on a host.
The affected product is Johnson Controls Simplex Incident Manager, with versions up to and including V2.01 listed as known affected. CISA rated the issue 5.8 on CVSS v3 and 5.8 on CVSS v4.0, both in the medium range. The advisory classifies the bug as cleartext storage of sensitive information in memory under CWE-316.
CISA said the affected product is deployed worldwide and is used in sectors that include critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy. The advisory lists Johnson Controls Inc. as the vendor and says the company headquarters is in Ireland.
Mitigation guidance in the advisory says Johnson Controls has released a patched version, V2.01.01. CISA also relayed vendor advice to upgrade, restrict local access to authorized personnel, use endpoint protection and monitoring to detect memory-dumping tools or suspicious processes, enforce least privilege and strong access control, use full-disk encryption and secure boot, and monitor unauthorized local access attempts with audit logging.
CISA said no known public exploitation specifically targeting this vulnerability had been reported to the agency at the time of publication. The advisory also says Johnson Controls reported the flaw to CISA.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()