Advisories › Johnson Controls › ICSA-26-204-02
Johnson Controls XAAP Android: 1 CVE, Low 3.3
Summary
CISA reports 1 vulnerability in Johnson Controls XAAP Android. Weakness type: Cleartext Storage of Sensitive Information. Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. Highest CVSS v3 score: 3.3 (Low), not remotely exploitable per its CVSS vector.
What to do: Plan: Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.
At a glance
- Vendor
- Johnson Controls
- Products
- XAAP Android
- CVEs
- CVE-2026-34490
- Highest CVSS v3
- 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-34490 | Cleartext Storage of Sensitive Information | 3.3 | – | No | A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device e… |
Affected products (1)
- Johnson Controls XAAP Android: <1.53
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.
- Mitigation: Johnson Controls recommends users restrict physical access to devices running the XAAP Android application.
- Mitigation: Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place.
- Mitigation: Johnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities.
- Mitigation: Johnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.