CVE-2025-61740
Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error
- Published
- Updated
- Reserved
- Assigned by
- jci
Description
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| jciCNA (assigner) | 4.0 | High7.2 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N |
| NVDNVD · Deferred | 4.0 | High7.2 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
Johnson Controls · IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- affected IQ Panels2 – ≤ 2
- affected IQ Panels2+ – ≤ 2+
- affected IQHub
- affected IQPanel 4 – ≤ 4.6.0
- affected PowerG – ≤ 53.02
What to do
Solution: a. Update IQ Panel 4’s to version 4.6.1/4.6.1i b. Devices that support PowerG+ should use PowerG v53.05 or later. c. During the installation or enrollment of PowerG+ devices, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process d. Replace all End-of-Life Products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-61740)Record last updated .