CVE-2025-26379
Weak PRNG in PowerG Encryption Allows Packet Injection
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: Johnson Controls
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| johnson_controls | building_management_systems | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the use of a weak pseudo-random number generator in the encryption of PowerG packets. Because the random number generator is weak, an attacker may be able to predict or reproduce the encryption keys, allowing them to read or inject encrypted PowerG packets.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to intercept and read encrypted PowerG packets or inject malicious packets into the communication. This can lead to unauthorized access, data manipulation, or disruption of services relying on PowerG communications.