Dependency on Vulnerable Third-Party Component in Johnson Controls FX Server and Equipment
CVE-2025-43867

8.5HIGH

Key Information:

Vendor: Johnson Controls
Status: Fx Server; Fx80; Fx90
Vendor: CVE Published:; 13 November 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2025-43867?

The security flaw within Johnson Controls FX Server and related models FX80 and FX90 arises from the dependency on a vulnerable third-party component. This vulnerability introduces risks that could permit unauthorized access to, modification of, or deletion of files within the systems. Users of affected versions are encouraged to upgrade to the latest releases to mitigate potential security risks.

Affected Version(s)

FX Server 0 < 14.10.10

FX Server 0 < 14.14.1

FX80 0 < 14.14.10

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Apr 17, 2025

CVE-2025-43867 Data

JSON