PT-2025-49245 · Johnson Controls · Openblue Mobile Web Application+1

Published 2025-12-05 · Updated 2025-12-17 · CVE-2025-26381

Positive Technologies (AI Summary)

CVSS v4.0

6.5

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace versions 2025.1.2 and prior

Description Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace versions 2025.1.2 and prior are susceptible to a Direct Request ('Forced Browsing') issue. This could allow an attacker to gain unauthorized access to sensitive information. Successful exploitation may lead to exposure of sensitive data without authentication or user interaction.

Recommendations Upgrade to version 2025.1.3 or above to mitigate the vulnerability.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-26381

Affected Products

Openblue Mobile Web Application

Openblue Workplace

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-26381 · Security Note
• https://twitter.com/NCIIPC/status/1998000531500057044 · Twitter Post
• https://twitter.com/syedaquib77/status/1996824395604746363 · Twitter Post
• https://tyco.widen.net/view/pdf/xmejieec4b/JCI-PSA-2025-05.pdf?t.download=true&u=aiurfs · Note
• https://twitter.com/VulmonFeeds/status/2001370416456114498 · Twitter Post
• https://https//www.cisa.gov/news-events/ics-advisories/icsa-25-338-03 · Note
• https://twitter.com/CVEnew/status/2001350800942219758 · Twitter Post