Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace

Risk Summary

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.

CVEs (1)

Remediations

• Johnson Controls Inc. recommends the following:
• Upgrade to patch level 2025.1.3 or above when available. Note: When this patch is applied, skip the below two steps.
• Disable the Mobile Application in Microsoft Internet Information Services (IIS) or Disable the mobile application within Microsoft Internet Information Services (IIS) at the application pool level.
• Use the primary OpenBlue Workplace web interface: To complete the tasks you've previously accomplished in OpenBlue Workplace Mobile interface, the primary Workplace web interface provides a subset of the Mobile functionality and is available here: [base url]/FMInteract/Default.aspx?DashboardType=Homepage.
• For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2025-05 v1 at the following location: https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Affected Vendors

Affected Products (1)

Affected Sectors

Commercial Facilities, Critical Manufacturing, Energy, Government Services and Facilities, Transportation Systems