> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Johnson Controls Inc. Airwall
- URL: https://f4n6.co.uk/security-feed/johnson-controls-inc-airwall/
- Published: 2026-08-13T20:31:34.000Z
- Updated: 2026-08-13T20:31:34.000Z
- Author: Jeff Davies
- Tags: #security-feed, CVE-2026-64887, CVE-2026-34492

## 1\. Executive summary

CISA published ICS advisory ICSA-26-225-03 disclosing two vulnerabilities in Johnson Controls Inc. (JCI) Airwall (versions ≤4.0.4). CVE-2026-64887 (CVSS v3.1: 6.8 MEDIUM, CVSS v4.0: 7.0 HIGH) is a hard-coded cryptographic key (CWE-321) identical across all installations, enabling decryption of sensitive configuration and database files by any actor with access to application code or binaries. CVE-2026-34492 (CVSS v3.1: 6.4 MEDIUM, CVSS v4.0: 5.9 MEDIUM) is an arbitrary file read vulnerability (CWE-73) exploitable via path traversal. Neither vulnerability is listed in CISA KEV and no public exploitation has been reported. EMEA financial services running Airwall for OT/physical access control segmentation face risk of sensitive data disclosure and authentication bypass; the vendor fix is Airwall v4.1.0 or later.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerabilities affect a physical access control / network segmentation product, but the advisory discloses flaws with no confirmed exploitation, no reported incident, and no distinctive trigger that changes a client's specific obligations under the provided regulatory reference. Standard patch-management and ICT risk practices apply but do not uniquely engage a named article.

## 3\. Technical analysis & attack chain

**Affected products:** Johnson Controls Inc. Airwall, all versions ≤4.0.4.

### CVE-2026-64887 — Use of Hard-coded Cryptographic Key (CWE-321)

- CVSS v3.1: 6.8 (MEDIUM) — `CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`
- CVSS v4.0: 7.0 (HIGH) — `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`
- **Mechanism:** A hardcoded cryptographic key is embedded in the Airwall application, identical across all installations and all customer organisations. An attacker with access to application code or binary files can extract the key and use it to decrypt sensitive application data stored in configuration and database files. Because the key is universal, a single disclosure (e.g., published online, leaked in a repository) grants access to every affected deployment simultaneously. The vulnerability is local (AV:L), requiring no privileges or user interaction.
- **Impact:** Decryption of sensitive configuration and database files; data disclosure; potential compromise of application infrastructure. Authentication bypass is possible because the hardcoded credential creates a systemic authentication failure that is difficult to detect or remediate without patching.

### CVE-2026-34492 — External Control of File Name or Path (CWE-73)

- CVSS v3.1: 6.4 (MEDIUM) — `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L`
- CVSS v4.0: 5.9 (MEDIUM) — `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N`
- **Mechanism:** User-supplied input is passed directly to filesystem access functions without adequate validation or sanitisation. An attacker can request arbitrary files on the server — including configuration files, source code, credential stores, and private keys — limited only by the application process's filesystem permissions. Exploitation vectors include path traversal sequences (`../`), absolute file paths (e.g., `/etc/passwd`), and encoding variations (`%2e%2e%2f`) to bypass basic filters. The attack is network-based (AV:N) but requires high attack complexity and user interaction (UI:R).
- **Impact:** Arbitrary file read; exposure of credentials, private keys, and configuration data; potential further compromise using exfiltrated secrets.

### Confirmed attack chain (CVE-2026-64887)

1. Attacker obtains access to Airwall application code or binary files (via supply-chain compromise, repository access, or prior exploitation of CVE-2026-34492).
2. Attacker extracts the hardcoded cryptographic key.
3. Attacker uses the key to decrypt sensitive data in configuration and database files across any affected deployment.
4. Decrypted credentials/configuration enable further access, authentication bypass, or infrastructure compromise.

### Confirmed attack chain (CVE-2026-34492)

1. Attacker sends a crafted request to the Airwall application containing a path traversal or absolute path payload (e.g., `../`, `%2e%2e%2f`, `/etc/passwd`).
2. The application passes the unsanitised input to a filesystem access function.
3. The server returns the contents of the requested file, subject to application process permissions.
4. Attacker retrieves sensitive files (configuration, credential stores, private keys) for further exploitation.

**CISA assessment:** Neither vulnerability is remotely exploitable per CISA's advisory statement. Both carry high attack complexity. No known public exploitation targeting these vulnerabilities has been reported to CISA. No CISA KEV listing.

**Confidence note:** All technical detail is sourced from CISA ICSA-26-225-03 and the corresponding JCI product security advisories (JCI-PSA-2026-18, JCI-PSA-2026-25). No additional vendor or third-party corroboration was available at time of writing. Single-sourced; verify before enforcement.

## 4\. Mitigation & containment

### P1 — Within 24 hours

- **Inventory and exposure assessment:** Identify all Airwall deployments across the estate. Confirm versions. Any deployment ≤4.0.4 is affected.
- **Network isolation:** Ensure Airwall devices are not accessible from the internet. Place all control system networks and remote devices behind firewalls, isolated from business networks. CISA explicitly recommends minimising network exposure for all control system devices.
- **Access restriction:** Restrict access to Airwall application code, binaries, configuration files, and database files to authorised personnel and processes only. Apply least-privilege filesystem permissions to the application process.

### P2 — Within 72 hours

- **Apply vendor fix:** Upgrade all Airwall appliances to v4.1.0 or later. This is the primary remediation for both CVE-2026-64887 and CVE-2026-34492.
- **Review for prior compromise:** Audit configuration and database files for evidence of unauthorised access. If the hardcoded key has been disclosed (check public repositories, paste sites, secrets-scanning results), assume all affected deployments are compromised and rotate all credentials and keys stored in Airwall configuration.
- **Harden deployments:** Apply the JCI universal hardening guide: https://www.johnsoncontrols.com/trust-center/cybersecurity/resources
- **Remote access:** Where remote access is required, use VPN with current versions. Recognise VPN is only as secure as the connected devices.

### P3 — Within 7 days

- **Key management overhaul (CVE-2026-64887):** Migrate cryptographic key storage to a secure KMS or HSM. Implement per-deployment unique keys. Establish a key rotation policy. Remove hardcoded keys from any internal source code repositories or binaries. Deploy secrets-scanning in CI/CD pipelines.
- **Input validation hardening (CVE-2026-34492):** Ensure file path inputs are canonicalised before validation. Implement strict allowlists for permitted file paths and directories. Consider sandboxing or chroot jails to restrict the application's filesystem scope.
- **Monitoring:** Enable detailed logging on Airwall hosts. Monitor for anomalous file access patterns, particularly requests containing path traversal sequences (`../`, `%2e%2e%2f`, absolute paths to `/etc/passwd`, credential stores, or private key files).
- **Refer to vendor advisories:** JCI-PSA-2026-25 (CVE-2026-64887) and JCI-PSA-2026-18 (CVE-2026-34492) at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

### Behavioural indicators

| Behaviour                                                                                                                                               | Where to observe                                           | Confidence                                                        |
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------- |
| Filesystem access requests containing path traversal sequences (../, %2e%2e%2f) or absolute paths (e.g., /etc/passwd) targeting the Airwall application | Web server logs, WAF logs, application logs, IDS/IPS       | High — directly described in CVE-2026-34492 advisory              |
| Decryption of Airwall configuration or database files using a key extracted from application binaries                                                   | Host-level file access auditing, DLP, database access logs | Medium — described as the exploitation outcome for CVE-2026-64887 |
| Access to application code or binary files by unauthorised users or processes                                                                           | File integrity monitoring, EDR, filesystem audit logs      | Medium — prerequisite for CVE-2026-64887 exploitation             |

## 6\. Detection

Insufficient indicators to author detection rules. The source material describes vulnerability mechanisms and exploitation techniques but does not provide specific artefacts (strings, file names, registry keys, mutex names, command-line arguments, or network signatures) attributable to a threat actor or malicious payload. Path traversal patterns (`../`, `%2e%2e%2f`) are generic and not distinctive enough to author a reliable YARA or Sigma rule without false-positive risk.

## 7\. Sources

- CISA, *Johnson Controls Inc. Airwall* (ICSA-26-225-03), https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03, 2026-08-13
- Johnson Controls, *JCI-PSA-2026-25* (CVE-2026-64887), https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- Johnson Controls, *JCI-PSA-2026-18* (CVE-2026-34492), https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- Johnson Controls, *Universal Hardening Guide*, https://www.johnsoncontrols.com/trust-center/cybersecurity/resources

## 8\. Adverse Trace position

Both vulnerabilities are rated MEDIUM under CVSS v3.1, with CVE-2026-64887 escalating to HIGH under CVSS v4.0\. The hardcoded cryptographic key flaw (CVE-2026-64887) is the more strategically significant issue: a single universal key across all installations means that one disclosure creates a systemic risk to every affected deployment simultaneously, and the local access vector is achievable through prior exploitation of CVE-2026-34492's arbitrary file read. Neither CVE is in CISA KEV and no active exploitation has been reported, but the combination of file read → key extraction → universal decryption constitutes a realistic attack chain for a motivated adversary targeting physical access control infrastructure. EMEA financial services clients running Airwall ≤4.0.4 should treat the upgrade to v4.1.0 as a P2 priority and immediately verify that Airwall devices are not internet-exposed. We will monitor for KEV addition, key disclosure on public platforms, and any JCI supplementary guidance. Confidence is moderate — all technical detail is single-sourced from CISA and JCI advisories; verify vendor fix availability and hardening guidance directly before enforcement.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*