CVE-2025-26379CWE-338

CVE-2025-26379

published December 22, 2025

CVSS
7.2
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2025-12-22T20:16Z
References (2)
https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02 · [email protected]https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 22 DEC 14:21Z
    Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator
    cvelistv5