Johnson Controls PowerG, IQPanel and IQHub (Update A)

Summary

Vulnerabilities 4

• High 7.2
  CVE-2025-26379

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

  Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
  Dec 22, 2025
• High 7.2
  CVE-2025-61739

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

  Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
  Dec 22, 2025
• High 7.2
  CVE-2025-61740

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

  Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

  Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
  Dec 22, 2025
• Low 2.3
  CVE-2025-61738

  Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

  Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.

  Johnson Controls IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
  Dec 22, 2025

Revision history

1. 2026-03-05 #2

   Update A - Updated vulnerability description 3.2.1, added additional mitigation details and updated vendor advisory link

2. 2025-12-16 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-350-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks