CVE-2026-34490: Johnson Controls XAAP Android Cleartext Storage — Detection and Remediation

By Senior Security Consultant, Security Arsenal

Introduction

Defenders in the Critical Manufacturing sector need to be on immediate alert regarding CVE-2026-34490, a significant security flaw identified in the Johnson Controls XAAP Android application (Fire Solutions). While the CVSS base score is 3.3 (Low), the operational impact in an industrial environment is substantially higher. The application—used to manage and interface with fire safety systems—stores sensitive information locally on the Android device without encryption.

In operational technology (OT) environments, mobile devices are frequently used by technicians in the field and are susceptible to theft or loss. This vulnerability creates a pathway for an attacker with physical access to a device—or who has otherwise compromised the device—to extract confidential configuration data or credentials. This post outlines the technical mechanics of the flaw and provides the necessary detection logic and remediation steps to secure your mobile fleet.

Technical Analysis

• Affected Product: Johnson Controls XAAP Android (Fire Solutions Application)
• Affected Versions: Versions prior to 1.53 (< 1.53)
• CVE Identifier: CVE-2026-34490
• CVSS v3 Score: 3.3 (Low)
• CWE: CWE-312 (Cleartext Storage of Sensitive Information)

Vulnerability Mechanics

The Johnson Controls XAAP Android application fails to implement adequate encryption controls for data at rest. Specifically, the application stores sensitive data (likely including authentication tokens, API keys, or local configuration files related to fire solution infrastructure) in the device's local storage in cleartext.

On the Android platform, this typically involves insecure storage in:

1. Shared Preferences: XML files stored in /data/data/com.package.name/shared_prefs/.
2. SQLite Databases: Unencrypted .db files.
3. Internal/External Storage: Plain text files.

Attack Chain

1. Physical Access/Device Compromise: An attacker gains physical possession of a technician's unattended device or compromises the device via malware.
2. Data Extraction: The attacker uses standard Android Debug Bridge (ADB) tools or file manager access (if the device is rooted) to navigate to the application's private storage directories.
3. Exfiltration: Because the data is not encrypted, the attacker reads the files directly, obtaining sensitive information that could be used to pivot into the broader fire control network or impersonate legitimate technicians.

Exploitation Status

As of the CISA advisory release (ICSA-26-204-02), this vulnerability is identified as a design weakness. While no active, widespread exploitation campaign has been flagged, the barrier to entry is low for anyone with physical access to the device.

Detection & Response

Detecting the presence of this vulnerable application requires a two-pronged approach: identifying the installation of the outdated app on managed devices and monitoring for potential data extraction attempts via ADB on workstations used to manage these devices.

SIGMA Rules

The following Sigma rules detect ADB backup commands, which are a primary method for extracting cleartext application data from Android devices.

---
title: Potential ADB Backup Extraction Activity
id: 8a5f1c92-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects usage of Android Debug Bridge (ADB) backup commands. In the context of CVE-2026-34490, this may indicate an attempt to extract cleartext data from vulnerable applications like Johnson Controls XAAP.
references:
  - https://cisa.gov/news-events/ics-advisories/icsa-26-204-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\adb.exe'
    CommandLine|contains: 'backup'
  condition: selection
falsepositives:
  - Authorized mobile device backups by IT staff
level: low

KQL (Microsoft Sentinel / Defender)

Use this KQL query to hunt for vulnerable versions of the application in your mobile device inventory logs (e.g., Intune or MDM data ingested into Sentinel).

// Hunt for Johnson Controls XAAP Android versions vulnerable to CVE-2026-34490
DeviceAppInventory
| where Name contains "Johnson Controls" or Name contains "XAAP"
| where Version < "1.53"
| project DeviceName, DeviceId, Name, Version, InstalledDate, TimeGenerated
| order by TimeGenerated desc

Velociraptor VQL

This VQL artifact hunts for the installed package on Android endpoints managed by Velociraptor.

-- Hunt for vulnerable Johnson Controls XAAP Android app installation
SELECT Name, PackageName, Version, VersionCode, InstallTime
FROM android_packages()
WHERE Name =~ "Johnson Controls" 
   OR PackageName =~ "xaap"
   OR PackageName =~ "johnson"

Remediation Script (Bash)

This script is intended for security administrators to verify connected Android devices for the presence of the vulnerable app version via ADB, acting as a triage tool if MDM reporting is delayed.

#!/bin/bash
# Verification Script for CVE-2026-34490
# Checks connected Android devices for vulnerable XAAP versions (< 1.53)

if ! command -v adb &> /dev/null; then
    echo "[!] Error: adb (Android Debug Bridge) is not installed or not in PATH."
    exit 1
fi

echo "[*] Scanning for Johnson Controls XAAP Android < 1.53..."

# Get list of connected device serials
DEVICES=$(adb devices | grep -w "device" | awk '{print $1}')

if [ -z "$DEVICES" ]; then
    echo "[!] No Android devices found."
    exit 0
fi

for SERIAL in $DEVICES; do
    echo "------------------------------------------------"
    echo "[*] Scanning Device: $SERIAL"
    
    # List packages matching likely naming conventions
    PACKAGES=$(adb -s "$SERIAL" shell pm list packages | grep -iE "johnson|xaap")
    
    if [ -n "$PACKAGES" ]; then
        echo "[+] Found target application package(s):"
        echo "$PACKAGES"
        
        # Extract package name (removing 'package:' prefix)
        # Loop through all matches if multiple exist
        echo "$PACKAGES" | while read -r line; do
            PKG_NAME=$(echo "$line" | cut -d: -f2)
            echo "[*] Checking version for: $PKG_NAME"
            
            # Get version info
            adb -s "$SERIAL" shell dumpsys package "$PKG_NAME" | grep -E "versionName=" | sed 's/.*versionName=//'
            
            echo "[!] Action Required: Verify version is >= 1.53."
        done
    else
        echo "[-] No Johnson Controls XAAP application found."
    fi
done
echo "------------------------------------------------"
echo "[*] Scan complete."

Remediation

To mitigate the risks associated with CVE-2026-34490, apply the following controls immediately:

1. Update Application: The primary remediation is to update the Johnson Controls XAAP Android application to version 1.53 or later. This version addresses the cleartext storage weakness.
2. Verify Vendor Advisory: Review the official CISA Advisory ICSA-26-204-02 for the latest patch links and vendor notifications.
3. Enforce Mobile Device Management (MDM) Policies:
   • Application Whitelisting/Blacklisting: Configure MDM solutions to deny installation or execution of versions < 1.53.
   • Disable USB Debugging: Ensure that "Developer Options" and "USB Debugging" are disabled on all field devices to prevent easy ADB extraction. This should be enforced via MDM policy.
   • Device Encryption: Mandate Full Disk Encryption (FDE) or File-Based Encryption on all Android devices used in operational environments. While the app stores data poorly, device encryption adds a critical layer of protection at rest.
4. Physical Security Review: Reinforce protocols for the physical security of mobile devices used in Critical Manufacturing sectors. Lost devices should be treated as potential security breaches requiring immediate remote wiping.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub