CISA 2026-07-23

Johnson Controls XAAP Android

CVE-2026-34490

Machine-generated analysis · WAYSCloud LLM

Versions of the Johnson Controls XAAP Android app prior to 1.53 store data in cleartext on the device.

Context

The advisory concerns the Johnson Controls XAAP Android application used in fire-solution equipment. Versions earlier than 1.53 store application data locally without encryption, allowing an attacker with physical access to read the data in plaintext. Exploitation does not require network access and is limited to the local device environment.

Operator considerations

Check: Verify which devices run XAAP Android versions earlier than 1.53.
Isolate: Restrict physical access to those devices and enforce screen-lock protections.
Patch: Update the XAAP Android application to version 1.53 or later.
Log: Monitor for unauthorized attempts to access device storage or for policy violations reported by MDM.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.

The following versions of Johnson Controls XAAP Android are affected:

XAAP Android

Read the full advisory on CISA →