{"id":"CVE-2025-43867","kind":"vulnerability","aliases":["CVE-2025-43867"],"related":[],"title":"Johnson Controls FX building controllers: vulnerable third-party component lets attackers modify files","description":"- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files.\n\nThis issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.","summary":"Johnson Controls FX Server, FX80 and FX90 building automation controllers ship a vulnerable third-party component. The sources say an attacker can access, modify or delete files on the device.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["building-automation","fx-server","fx80","fx90","infrastructure","johnson-controls"],"not_affected_if":["fixed-version"],"how_to_check":"- Identify FX Server, FX80 or FX90 devices and their firmware or server version in the building management inventory\n- Compare the installed version against the fixed ranges listed under Fix","fix":"- FX Server: `14.10.10` for the 14.10 line and `14.14.1` for the 14.14 line\n- FX80: `14.14.10` and `14.14.1`\n- FX90: `14.10.10` and `14.14.1`","status":"open","published_at":"2026-11-13T21:17:35+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","triaged_at":"2026-11-13T21:33:46+00:00","updated_at":"2026-11-13T21:33:46+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T21:33:46Z","model":"claude-haiku-5-5","output":{"fix":"- FX Server: `14.10.10` for the 14.10 line and `14.14.1` for the 14.14 line\n- FX80: `14.14.10` and `14.14.1`\n- FX90: `14.10.10` and `14.14.1`","reach":"unknown","title":"Johnson Controls FX building controllers: vulnerable third-party component lets attackers modify files","impact":"high","summary":"Johnson Controls FX Server, FX80 and FX90 building automation controllers ship a vulnerable third-party component. The sources say an attacker can access, modify or delete files on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["johnson-controls","building-automation","fx-server","fx80","fx90"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads, changes or deletes files on the controller","analyst_note":"Check the Johnson Controls advisory for the attack vector, privileges required and the exact vulnerable third-party component; NVD gave only the CAPEC summary.","how_to_check":"- Identify FX Server, FX80 or FX90 devices and their firmware or server version in the building management inventory\n- Compare the installed version against the fixed ranges listed under Fix\n- unknown whether the sources name a configuration check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Sites running Johnson Controls FX Server, FX80 or FX90 building automation equipment on a version below the fixed ranges. The sources do not describe the network path needed to reach the flaw, so exposure depends on whether these controllers are reachable from untrusted networks. Sites on the fixed versions are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4622,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-43867':17A,20A '14.10.10':98C,110C '14.14.1':101C,107C,113C '14.14.10':104C '17':86C 'access':56B,87C 'affect':94C 'allow':84C 'attack':12A,54B 'autom':23B,41B 'build':4A,22B,40B 'building-autom':21B 'capec':85C 'compon':10A,49B,70C 'control':2A,5A,32B,34B,42B,74C,78C,82C 'cve':15A,18A 'delet':59B,90C 'depend':64C 'devic':63B 'file':14A,60B,91C 'fx':3A,25B,35B,75C,95C 'fx-server':24B 'fx80':27B,37B,79C,102C 'fx90':28B,39B,83C,108C 'infrastructur':29B 'issu':93C 'johnson':1A,31B,33B,73C,77C,81C 'johnson-control':30B 'let':11A 'modifi':13A,57B,88C 'parti':9A,48B,69C 'say':52B 'server':26B,36B,76C,96C 'ship':43B 'sourc':51B 'third':8A,47B,68C 'third-parti':7A,46B,67C 'vulner':6A,45B,66C,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running Johnson Controls FX Server, FX80 or FX90 building automation equipment on a version below the fixed ranges. The sources do not describe the network path needed to reach the flaw, so exposure depends on whether these controllers are reachable from untrusted networks. Sites on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["buildingautomation","fx80","fx90","fxserver","high","infrastructure","johnsoncontrols"],"campaign_type":null,"search_a":"'-2025':16A,19A '-43867':17A,20A 'attack':12A 'build':4A 'compon':10A 'control':2A,5A 'cve':15A,18A 'file':14A 'fx':3A 'johnson':1A 'let':11A 'modifi':13A 'parti':9A 'third':8A 'third-parti':7A 'vulner':6A","search_b":"'access':56B 'attack':54B 'autom':23B,41B 'build':22B,40B 'building-autom':21B 'compon':49B 'control':32B,34B,42B 'delet':59B 'devic':63B 'file':60B 'fx':25B,35B 'fx-server':24B 'fx80':27B,37B 'fx90':28B,39B 'infrastructur':29B 'johnson':31B,33B 'johnson-control':30B 'modifi':57B 'parti':48B 'say':52B 'server':26B,36B 'ship':43B 'sourc':51B 'third':47B 'third-parti':46B 'vulner':45B","search_c":"'14.10.10':98C,110C '14.14.1':101C,107C,113C '14.14.10':104C '17':86C 'access':87C 'affect':94C 'allow':84C 'capec':85C 'compon':70C 'control':74C,78C,82C 'delet':90C 'depend':64C 'file':91C 'fx':75C,95C 'fx80':79C,102C 'fx90':83C,108C 'issu':93C 'johnson':73C,77C,81C 'modifi':88C 'parti':69C 'server':76C,96C 'third':68C 'third-parti':67C 'vulner':66C,71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-43867","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43867","severity":null,"published_at":"2026-11-13T21:17:35+00:00","modified_at":"2026-11-13T21:17:35+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","fetched_at":"2026-11-13T21:33:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}