---
cve: "CVE-2026-27871"
severity: "LOW"
cvss: 2.9
epss: "27%"
vendor: "Johnson Controls"
kev: false
exploited: false
published: "2026-08-14 20:16:52"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T00:38:53+02:00"
---

# CVE-2026-27871

> 2.9 LOW

## Beschreibung

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack.

This issue affects TL280: before 5.63.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-327** — Use of a Broken or Risky Cryptographic Algorithm
  The product uses a broken or risky cryptographic algorithm or protocol.

## Angriffsmuster (CAPEC)

- [CAPEC-20 — Encryption Brute Forcing](https://capec.mitre.org/data/definitions/20.html) _(Severity: Low)_
- [CAPEC-97 — Cryptanalysis](https://capec.mitre.org/data/definitions/97.html) _(Severity: Very High)_
- [CAPEC-459 — Creating a Rogue Certification Authority Certificate](https://capec.mitre.org/data/definitions/459.html) _(Severity: Very High)_
- [CAPEC-473 — Signature Spoof](https://capec.mitre.org/data/definitions/473.html)
- [CAPEC-475 — Signature Spoofing by Improper Validation](https://capec.mitre.org/data/definitions/475.html) _(Severity: High)_
- [CAPEC-608 — Cryptanalysis of Cellular Encryption](https://capec.mitre.org/data/definitions/608.html) _(Severity: High)_
- [CAPEC-614 — Rooting SIM Cards](https://capec.mitre.org/data/definitions/614.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1036.001 — Masquerading: Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001/)
- [T1553.002 — Subvert Trust Controls: Code Signing](https://attack.mitre.org/techniques/T1553/002/)

## Referenzen

- <https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-27871) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_