CISA warns of two Airwall flaws, urges Johnson Controls update
CISA said two Airwall vulnerabilities could expose sensitive data or allow arbitrary file reads in affected versions 4.0.4 and earlier.
CISA on Aug. 13 issued an advisory on Johnson Controls Inc. Airwall, saying versions 4.0.4 and earlier are affected by two vulnerabilities and should be updated to v4.1.0 or later.
CISA said one flaw could expose sensitive application data if an attacker gets access to application code or binaries. The other could allow an attacker to read arbitrary files on a server when the process has permission. The agency said no known public exploitation specifically targeting the issues had been reported to it at the time.
What CISA said
CISA identified the first issue as CVE-2026-64887. It described the flaw as a hardcoded password or cryptographic key in the Airwall application. CISA said the key is the same across installations and customer organizations, which could let an attacker decrypt sensitive data stored in configuration and database files if they obtain the application code or binaries.
The agency assigned CVSS v3.1 and v4.0 scores of 6.8, medium, and 7, high, respectively, to that vulnerability. It said the related weakness is CWE-321, use of hard-coded cryptographic key.
CISA also listed CVE-2026-34492, which it described as an arbitrary file read issue. According to the advisory, user-supplied input is incorporated into file system access functions without adequate validation or sanitization. If the process has permission, an attacker could read server files including configuration files, source code, credential stores and private keys.
CISA gave that issue CVSS v3.1 and v4.0 scores of 6.4, medium, and 5.9, medium, and said the related weakness is CWE-73, external control of file name or path.
Background and context
The advisory says Johnson Controls reported the vulnerabilities to CISA. Its revision history lists the item as an initial republication of Johnson Controls JCI-PSA-2026-18 and JCI-PSA-2026-25.
CISA said the vulnerabilities are not exploitable remotely and have high attack complexity. The agency also listed several critical infrastructure sectors tied to the product, including Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy.
What happens next
CISA recommended applying v4.1.0 or later patches for all Airwalls. The advisory says the products are deployed worldwide and lists Johnson Controls’ headquarters location as Ireland.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()