CVE-2025-61739
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption
- Published
- Updated
- Reserved
- Assigned by
- jci
Description
Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| jciCNA (assigner) | 4.0 | High7.2 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N |
| NVDNVD · Deferred | 4.0 | High7.2 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.19% · top 92% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
Johnson Controls · IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- affected IQPanel2 – ≤ 2
- affected IQ Panels 2+ – ≤ 2+
- affected IQHub
- affected IQPanel 4 – ≤ 4.6.0
What to do
Solution: a. Update IQ Panel 4’s to version 4.6.1/4.6.1i b. Devices that support PowerG+ should use PowerG v53.05 or later. c. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process d. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-61739)Record last updated .