# Fire Safety App Stores Sensitive Data in Plaintext — Johnson Controls XAAP Needs an Immediate Update


## The Threat


Johnson Controls has disclosed a cleartext storage vulnerability in XAAP, the Android companion application used to manage its fire solutions systems. The flaw is straightforward and unambiguous: the app writes application data to local device storage without encryption, meaning anyone who gets into the device — physically or through a secondary exploit — can read that data in plaintext.


The vulnerability is classified under CWE-312, a category that should never appear in applications managing fire safety infrastructure. These aren't vanity apps; XAAP runs on tablets and handhelds used by technicians and security personnel in manufacturing facilities, data centers, and other environments where fire detection and suppression data has operational and safety implications. Sensitive configuration, credentials, or site data sitting unencrypted on a device that gets lost, stolen, or compromised is a real exposure — not a theoretical one.


CISA's advisory makes the exploitation chain sound benign because it requires local access, but that framing undersells the risk in industrial environments. Technician devices routinely move across sites, get handed off between shifts, and sometimes disappear. Cleartext local storage means a single lost phone or tablet becomes a full data disclosure, no network connection required.


## Severity and Impact


| CVE | CVSS Version | Base Score | Severity | Vector String | Attack Complexity | Auth Required |

|-----|-------------|------------|----------|---------------|-------------------|---------------|

| CVE-2026-34490 | 3.1 | 3.3 | LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | Low | Low privileges |

| CVE-2026-34490 | 4.0 | 4.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | Low | Low privileges |


CWE: CWE-312 — Cleartext Storage of Sensitive Information

Attack Vector: Local only; no network access required

Scope: Confidentiality impact only — no integrity or availability risk


The jump from 3.3 to 4.8 when scored under CVSS 4.0 is worth noting. The newer scoring framework more accurately reflects the real-world ease of exploitation: low complexity, no user interaction needed once the device is accessed, and no additional conditions required. Organizations still anchoring risk decisions to v3.1 scores alone may be systematically undervaluing vulnerabilities like this one.


## Affected Products


  • Johnson Controls XAAP Android — all versions prior to 1.53

    • No other product lines are listed as affected. The vulnerability is specific to the Android mobile application for the XAAP Fire Solutions platform. The company is headquartered in Ireland and deploys this software globally across critical manufacturing sectors.


    ## Mitigations


    Primary fix — update the application:


  • Upgrade XAAP Android to version 1.53 or later. This is the only remediation that actually closes the vulnerability. All other measures are compensating controls.

    • Physical security controls:


  • Restrict physical access to all devices running XAAP Android
  • Never leave devices unattended in unsecured areas or vehicles

    • Device hardening:


  • Enable full-disk encryption on all Android devices running XAAP (required by Android 10+ on most hardware, but verify it is actively enforced)
  • Run fully patched Android OS versions — older OS versions may have encryption or storage weaknesses that compound this flaw
  • Enforce screen lock with strong authentication (PIN of 6+ digits or biometric)

    • Mobile Device Management:


  • Deploy an MDM solution to enforce encryption policies, application whitelisting, and remote wipe capability
  • Configure MDM to trigger automatic wipe after a defined number of failed unlock attempts
  • Use MDM to audit which devices have XAAP installed and confirm version 1.53 adoption

    • Operational controls:


  • Do not root or jailbreak any device used in production environments — rooting bypasses OS-level storage protections that partially compensate for application-level cleartext storage
  • For complete guidance, reference Johnson Controls Product Security Advisory JCI-PSA-2026-10

    • ## References


  • [CISA ICS Advisory — Johnson Controls XAAP Android](https://www.cisa.gov/news-events/ics-advisories/)
  • Johnson Controls Product Security Advisory: JCI-PSA-2026-10
  • [CWE-312: Cleartext Storage of Sensitive Information](https://cwe.mitre.org/data/definitions/312.html)
  • [CISA ICS Security Recommended Practices](https://www.cisa.gov/ics)

    • ---


    ## HackWire Analysis


    The CVSS score on this one — 3.3 under v3.1 — will cause some organizations to deprioritize it. That would be a mistake, and not just because the newer v4.0 scoring bumps it to medium.


    The deeper issue is context. XAAP is a fire solutions management application. The data stored locally on these devices likely includes facility layouts, suppression system configurations, access credentials, or maintenance histories for fire suppression infrastructure at critical manufacturing sites. That's not generic app data — that's the kind of information an insider threat or a targeted attacker would find genuinely useful before or during a physical intrusion.


    ICS mobile companion apps have a documented history of poor data handling. We've seen this pattern repeatedly over the past five years: industrial vendors build capable OT management software, then bolt on an Android app for field technicians, and the mobile client doesn't receive the same security scrutiny as the core platform. Cleartext local storage is often an artifact of early development decisions that never get revisited until a researcher or regulator flags them.


    What makes this more actionable than a typical low-score advisory is the MDM angle. Many organizations operating in critical manufacturing environments already have MDM infrastructure deployed — but XAAP-specific policies may not have been configured on it. Security teams should treat this disclosure as a forcing function: audit which devices have XAAP installed, confirm full-disk encryption is active and enforced by policy, and verify the update to 1.53 has been pushed across the fleet before that audit closes.


    Physical device security in industrial environments is notoriously inconsistent. A technician's tablet left in a truck overnight or handed to a contractor without proper off-boarding is a common, human scenario — and that's exactly the attack surface this vulnerability lives in.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)