CISA 2026-08-06

Johnson Controls Inc. TL280

CVE-2026-27871

Machine-generated analysis · WAYSCloud LLM

TL280 firmware versions earlier than 5.63 contain hard-coded credentials. Exploitation could allow access to sensitive information on the device.

Context

The advisory concerns Johnson Controls Inc. TL280 devices. Versions earlier than 5.63 have hard-coded credentials that could allow an attacker to access sensitive information on the device. The devices are deployed worldwide across critical manufacturing, commercial facilities, government services, transportation systems, and energy sectors. Johnson Controls recommends applying firmware update 5.63 and restricting network access to trusted management VLANs.

Operator considerations

Check: Verify TL280 devices are running firmware version earlier than 5.63.
Patch: Apply firmware update 5.63 provided by Johnson Controls.
Isolate: Restrict network access to the devices to trusted management VLANs and avoid internet exposure.
Log: Monitor device access logs for anomalous authentication activity.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device.

The following versions of Johnson Controls Inc. TL280 are affected:

TL280

Read the full advisory on CISA →