CVE-2025-43867

{
  "etk_id": "ETK-2026-4423",
  "cve_id": "CVE-2025-43867",
  "display_id": "CVE-2025-43867",
  "ghsa_id": "GHSA-6x23-3fm3-m5mr",
  "euvd_id": "EUVD-2025-211325",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Vulnerable third-party dependency in Johnson Controls FX products",
  "summary": "Johnson Controls FX Server, FX80, and FX90 releases below the listed fixed versions include a vulnerable third-party dependency. An attacker may access, modify, or delete device configuration files; the required access conditions are not established by the available evidence.",
  "mitigation": "Upgrade FX Server and FX90 to 14.10.10 or 14.14.1, and upgrade FX80 to 14.14.10 or 14.14.1. Until upgrades are complete, restrict access to affected management interfaces and configuration files to authorized users and networks.",
  "vendor": "Johnson Controls",
  "product": "FX Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 14.10.10",
        ">= 0, < 14.14.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.10.10",
        "14.14.1"
      ],
      "package_name": "FX Server",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 14.14.10",
        ">= 0, < 14.14.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.14.10",
        "14.14.1"
      ],
      "package_name": "FX80",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 14.10.10",
        ">= 0, < 14.14.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.10.10",
        "14.14.1"
      ],
      "package_name": "FX90",
      "purl": null
    }
  ],
  "cwes": [
    1395
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 11.2680858,
  "t0_at": "2026-11-13T20:14:16.172000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-13T20:46:55.387249+00:00",
      "days": 0.02267610241898148,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T20:14:16.172000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-13T20:14:16.172000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T20:14:16.172000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43867"
    }
  }
}