CVE-2026-34490
Received Received - Intake

Cleartext Storage of Sensitive Data in Johnson Controls XAAP Android App

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Johnson Controls

Description
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-34490
EUVD
EUVD-2026-51576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
johnson_controls x_aap_application to 1.53 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the storage of sensitive information in cleartext by the Johnson Controls XAAP Application on Android. An attacker with access to a jailbroken or otherwise compromised device could retrieve this sensitive data.

Detection Guidance

Detection requires checking if the XAAP Application version is before 1.53 on Android devices. Inspect installed applications for XAAP and verify version details through device settings or package manager commands like 'adb shell pm list packages -f' and 'adb shell dumpsys package <package_name>'.

Impact Analysis

If you use the XAAP Application on Android before version 1.53, an attacker could exploit this flaw to access sensitive data stored by the app, potentially leading to data breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA, as it involves the exposure of sensitive data due to inadequate protection. Organizations may face legal penalties or reputational damage if such data is compromised.

Mitigation Strategies

Update the XAAP Application to version 1.53 or later immediately. Remove or disable the application if an update is not available. Ensure devices are not jailbroken or compromised to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart