NCC Group, a prominent cybersecurity consultancy, has recently unveiled the discovery of four significant security flaws within the Johnson Controls PowerG wireless building security protocol. This disclosure brings to light potential vulnerabilities in a widely deployed system integral to modern building management and security infrastructure.

The PowerG wireless protocol is a cornerstone of many contemporary security installations, facilitating robust and reliable communication across various components such as sensors, motion detectors, and control panels. Its widespread adoption underscores the importance of rigorous security assessments to maintain the integrity of physical security systems.

Understanding the Disclosed Vulnerabilities

The identified security flaws concern critical aspects of the PowerG protocol’s operation. While specific technical details of each flaw are extensive, their collective presence points to potential avenues that could be exploited if not properly addressed. These vulnerabilities highlight the complex challenges in securing wireless communication protocols, especially those operating in sensitive environments like building security.

The three explicitly named Common Vulnerabilities and Exposures (CVE) identifiers associated with this disclosure are:

• CVE-2025-61738
• CVE-2025-26379
• CVE-2025-61739

The existence of these flaws signifies potential weaknesses that could lead to unauthorized interactions with the security system. In general, vulnerabilities within wireless security protocols can open doors for bypasses of security measures or the compromise of system data, emphasizing the necessity for prompt and effective remediation strategies.

Implications for Building Security

The revelation by NCC Group serves as a crucial reminder for organizations utilizing Johnson Controls PowerG systems to remain vigilant. The integrity of building security protocols is paramount, as they often safeguard critical assets, infrastructure, and personnel. Ensuring these systems are protected against potential exploits is a continuous effort that requires collaboration between security researchers and product vendors.

This disclosure by NCC Group reinforces the essential role independent security research plays in identifying and reporting vulnerabilities before they can be maliciously exploited. It underscores the ongoing commitment within the cybersecurity community to enhance the safety and resilience of digital and physical infrastructures globally.

Stakeholders in charge of building security and IT infrastructure are encouraged to stay informed on the specific details of these flaws and follow any advisories or patches released by Johnson Controls to mitigate associated risks effectively.