CVE-2025-61740 HIGH

CVE-2025-61740: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Weakness CWE-346 · Origin validation

Published December 22, 2025

Last update December 22, 2025

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

Key dates

02Disclosure timeline

December 22, 2025 CVE published

December 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-61740 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/346.html

Related vulnerabilities

Identifiers

CVE CVE-2025-61740

CWE CWE-346

CVSS 7.2 / HIGH

Affected versions

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Affected ≥ IQ Panels2 and ≤ 2

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Affected ≥ IQ Panels2+ and ≤ 2+

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Affected IQHub

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Affected ≥ IQPanel 4 and ≤ 4.6.0

Vendor Johnson Controls

Product IQ Panels2, 2+, IQHub, IQPanel 4, PowerG

Affected ≥ PowerG and ≤ 53.02

CVE-2025-61740: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

01Description

02Disclosure timeline

03References

04Related CVE