← Toutes les actualités
Johnson Controls C-CURE 9000 and Victor application server
Synthèse
Expand All + CVE-2026-34490 A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment. View CVE Details Affected Products Johnson Controls XAAP
Expand All + CVE-2026-34490 A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment. View CVE Details Affected Products Johnson Controls XAAP Android Vendor:Johnson Controls Product Version:Johnson Controls XAAP Android: <1. 53 Product Status:known_affected Remediations Vendor fixJohnson Controls recommends users update the XAAP Android application to version 1.
53 or later, which contains the fix for this vulnerability. MitigationJohnson Controls recommends users restrict physical access to devices running the XAAP Android application. MitigationJohnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place. MitigationJohnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities. MitigationJohnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.
MitigationFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10. Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3. 1 3. 3 LOW CVSS:3. 1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 4.
0 4. 8 MEDIUM CVSS:4.