Johnson Controls XAAP Android

Risk Summary

Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.

CVEs (1)

Remediations

• Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.
• Johnson Controls recommends users restrict physical access to devices running the XAAP Android application.
• Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place.
• Johnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities.
• Johnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.
• For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10.

Affected Vendors

Affected Products (1)

Affected Sectors

Critical Manufacturing