Johnson Controls TL280 up to 5.62 risky encryption

Summaryinfo

A vulnerability was found in Johnson Controls TL280 up to 5.62. It has been rated as problematic. This affects an unknown part. Performing a manipulation results in risky encryption. This vulnerability is reported as CVE-2026-27871. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Johnson Controls TL280 up to 5.62. This affects an unknown function. The manipulation with an unknown input leads to a risky encryption vulnerability. CWE is classifying the issue as CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. This is going to have an impact on confidentiality. The summary by CVE is:

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63.

The advisory is shared at johnsoncontrols.com. This vulnerability is uniquely identified as CVE-2026-27871 since 02/24/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

It is declared as proof-of-concept.

Upgrading to version 5.63 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Johnson Controls

Name

• TL280

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25
• 5.26
• 5.27
• 5.28
• 5.29
• 5.30
• 5.31
• 5.32
• 5.33
• 5.34
• 5.35
• 5.36
• 5.37
• 5.38
• 5.39
• 5.40
• 5.41
• 5.42
• 5.43
• 5.44
• 5.45
• 5.46
• 5.47
• 5.48
• 5.49
• 5.50
• 5.51
• 5.52
• 5.53
• 5.54
• 5.55
• 5.56
• 5.57
• 5.58
• 5.59
• 5.60
• 5.61
• 5.62

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion