CVE-2025-43867 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Johnson Controls FX Server, FX80 and FX90 building automation controllers ship a vulnerable third-party component. The sources say an attacker can access, modify or delete files on the device.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Johnson Controls FX Server, FX80 or FX90 building automation equipment on a version below the fixed ranges. The sources do not describe the network path needed to reach the flaw, so exposure depends on whether these controllers are reachable from untrusted networks. Sites on the fixed versions are not affected.
Not affected if fixed-version
Who cares building-automation, fx-server, fx80, fx90, johnson-controls
14.10.10 for the 14.10 line and 14.14.1 for the 14.14 line14.14.10 and 14.14.114.10.10 and 14.14.1This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.