Read the docs
TI-2026-69279 Aliases CVE-2026-34499GHSA-h9vm-53hv-75ch

Hard-coded cryptographic key in Johnson Controls ADVMS

Priority LOW 37CWE-321Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Johnson Controls ADVMS from 0 before 3.10 is affected. The product uses a hard-coded cryptographic key (CWE-321), a secret value fixed in the code. A local user with low privileges can read sensitive constants within the executable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00096 0th percentileScored 2026-11-07
Fix Fixed ADVMS (Johnson Controls): 3.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Johnson ControlsADVMSbefore 3.103.10Patch availableCNA
  • ADVMS VendorJohnson Controls Affected before 3.10 Fixed in 3.10 Patch available CNA

Remediation

Update Johnson Controls ADVMS to version 3.10 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA ADVMS (Johnson Controls) Fixed in 3.10

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-34499
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-h9vm-53hv-75ch

References

Other 1

  • TI-2025-19346 Metasys product command injection vulnerability could allow remote SQL execution CVSS 4.0CRITICAL 9.5
  • TI-2023-01901 Improper Authentication for OpenBlue Enterprise Manager Data Collector CVSS 3.1CRITICAL 10.0
  • TI-2023-04421 An unauthorized user could access debug features in Quantum HD Unity products that were… CVSS 3.1CRITICAL 10.0
  • TI-2026-17437 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVSS 4.0HIGH 8.8
  • TI-2025-19344 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool CVSS 4.0CRITICAL 9.3
  • TI-2023-03311 Missing brute-force protection in Johnson Controls IQ Wifi 6 CVSS 3.1CRITICAL 9.8
See all 125 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences