CVE-2026-64896 - Vulnerability Details - OpenCVE

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Johnson Controls	T2000

No data.

No data.

References

Link	Providers
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-732

Thu, 27 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.
Title		T2000 open debug port
First Time appeared		Johnson Controls Johnson Controls t2000
CPEs		cpe:2.3:a:johnson_controls:t2000::::::::
Vendors & Products		Johnson Controls Johnson Controls t2000
References		https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Metrics		cvssV4_0 `{'score': 5.2, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2026-08-27T14:42:33.253Z

Updated: 2026-08-27T19:31:48.139Z

Reserved: 2026-07-20T19:51:19.089Z

Link: CVE-2026-64896

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-27T17:19:23.820

Modified: 2026-08-27T20:18:20.347

Link: CVE-2026-64896

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64896", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "state": "PUBLISHED", "assignerShortName": "jci", "dateReserved": "2026-07-20T19:51:19.089Z", "datePublished": "2026-08-27T14:42:33.253Z", "dateUpdated": "2026-08-27T19:31:48.139Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2026-08-27T14:42:33.253Z"}, "title": "T2000 open debug port", "datePublic": "2026-08-25T14:32:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Debug and Test Interface With Improper Access Control"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Johnson Controls", "product": "T2000", "versions": [{"status": "affected", "version": "0", "lessThan": "31.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:johnson_controls:t2000:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "31.6"}]}]}], "descriptions": [{"lang": "en", "value": "Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects T2000: before 31.6.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects T2000: before 31.6.</p>"}]}], "references": [{"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "If immediate update is not possible, Johnson Controls recommends the following mitigations:\u00a0\n\n\n\n * \n\nRestrict physical access to the device by installing it in a secured equipment room that limits access to authorized service personnel only.\u00a0\n\n\n\n\n\n\n * \n\nImplement tamper-evident seals on device housings and panel enclosures to detect and deter unauthorized physical access attempts.\u00a0\n\n\n\n\n\n\n * \n\nConduct periodic physical inspections of device installations to identify signs of tampering, unauthorized cable connections, or enclosure breaches.\u00a0\n\n\n\n\n\n\n\n\nAdditional best-practice mitigations that end users can apply as a layer of defense:\u00a0\n\n\n\n * \n\nPhysically secure\u00a0the device\u00a0enclosure to prevent unauthorized access to internal circuit boards and ports.\u00a0\n\n\n\n\n\n\n * \n\nImplement authentication mechanisms on any accessible debug interfaces to restrict access to authorized service personnel only.\u00a0\n\n\n\n\n\n\n * \n\nMonitor physical access to device installations and implement tamper detection where possible.\u00a0\n\n\n\n\n\n\n * \n\nFollow the recommendations in the Johnson Controls Product Hardening Guide available at\u00a0 https://www.johnsoncontrols.com/trust-center/cybersecurity/resources .\u00a0\n\n\n\n\n\n\n\n\nThese mitigations reduce risk but may not fully remediate the vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><p>If immediate update is not possible, Johnson Controls recommends the following mitigations: </p></div><div><ul><li><p>Restrict physical access to the device by installing it in a secured equipment room that limits access to authorized service personnel only. </p></li></ul></div><div><ul><li><p>Implement tamper-evident seals on device housings and panel enclosures to detect and deter unauthorized physical access attempts. </p></li></ul></div><div><ul><li><p>Conduct periodic physical inspections of device installations to identify signs of tampering, unauthorized cable connections, or enclosure breaches. </p></li></ul></div><div><p>Additional best-practice mitigations that end users can apply as a layer of defense: </p></div><div><ul><li><p>Physically secure the device enclosure to prevent unauthorized access to internal circuit boards and ports. </p></li></ul></div><div><ul><li><p>Implement authentication mechanisms on any accessible debug interfaces to restrict access to authorized service personnel only. </p></li></ul></div><div><ul><li><p>Monitor physical access to device installations and implement tamper detection where possible. </p></li></ul></div><div><ul><li><p>Follow the recommendations in the Johnson Controls Product Hardening Guide available at <a href=\"https://www.johnsoncontrols.com/trust-center/cybersecurity/resources\" target=\"_blank\" rel=\"noreferrer noopener\">https://www.johnsoncontrols.com/trust-center/cybersecurity/resources</a>. </p></li></ul></div><div><p>These mitigations reduce risk but may not fully remediate the vulnerability.  </p></div>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}, {"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T19:31:28.626751Z", "id": "CVE-2026-64896", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T19:31:48.139Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "T2000", "vendor": "Johnson Controls", "versions": [{"lessThan": "31.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "productsecurity@jci.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects T2000: before 31.6."}], "id": "CVE-2026-64896", "lastModified": "2026-08-27T20:18:20.347", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "productsecurity@jci.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64896", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T19:31:28.626751Z", "version": "2.0.3"}}]}, "published": "2026-08-27T17:19:23.820", "references": [{"source": "productsecurity@jci.com", "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}