Advisories › Johnson Controls › ICSA-26-218-02
Johnson Controls Inc. TL280: 1 CVE, Medium 4.1
Summary
CISA reports 1 vulnerability in Johnson Controls TL280. Weakness type: Use of a Broken or Risky Cryptographic Algorithm. Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. Highest CVSS v3 score: 4.1 (Medium), exploitable over the network.
What to do: Plan: To help reduce the risk of exploitation, Johnson Control suggests considering the following defensive measures: Apply firmware update 5.63.
At a glance
- Vendor
- Johnson Controls
- Products
- TL280
- CVEs
- CVE-2026-27871
- Highest CVSS v3
- 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-27871 | Use of a Broken or Risky Cryptographic Algorithm | 4.1 | – | No | Hardcoded credentials refer to usernames, passwords, or other authentication information that are embedded directly into the source code of a firmware file. These credentials are often used to access system login and other areas of an application. |
Affected products (1)
- Johnson Controls Inc. TL280: <5.63
Vendor fixes and mitigations (from advisory)
- Vendor Fix: To help reduce the risk of exploitation, Johnson Control suggests considering the following defensive measures: Apply firmware update 5.63.
- Mitigation: Johnson Controls suggests the following defensive measures: Restrict network access to affected cameras to trusted management VLANs only - do not expose these devices directly to the internet or untrusted network segments.
- Mitigation: Monitor device access logs for any anomalous authentication activity.
- Mitigation: Rotate any shared or downstream credentials that may have been derived from or associated with the hard-coded values.
- Mitigation: Implement network segmentation and place ICS/SCADA devices and systems behind firewalls, isolating them from the business network.
- Mitigation: When remote access is required, use secure methods such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be kept up to date.
- Mitigation: Minimize network exposure for all control system devices and/or systems; ensure they are not accessible from the internet.
- Mitigation: Conduct regular firmware integrity checks to detect unauthorizedmodifications.
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-08 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.