What the PowerG alarm flaws mean for your panel

PowerG is the wireless protocol that links alarm sensors, sirens and other peripherals to a control panel in Johnson Controls' product line. James Chambers, a senior security consultant at NCC Group who co-reported the flaws, described its reach this way: "PowerG is used in devices such as motion detectors, cameras, smoke detectors, sirens, and smart locks." Trade coverage of the disclosure describes the protocol as deployed in homes and commercial premises.

The U.S. Cybersecurity and Infrastructure Security Agency published advisory ICSA-25-350-02 on 16 December 2025 and updated it on 5 March 2026. Johnson Controls published its own advisory, JCI-PSA-2025-01, on the same initial date and revised it the same day CISA did. I read both, plus the researcher's on-record description. Here's the list of what's affected, straight from CISA:

• PowerG firmware 53.02 and earlier
• IQ Panel 2 and IQ Panel 2+: all versions
• IQ Hub: all versions
• IQ Panel 4: versions before 4.6.1

CISA's one-line summary: "Successful exploitation of these vulnerabilities could allow an attacker to read or write encrypted traffic or perform a replay attack."

The four flaws, in plain terms

1. The key could be guessed (CVE-2025-26379). CISA files this under a weak pseudo-random number generator, scored 7.6, High. Chambers explained what that meant in practice: "Affected IQPanel control panel devices generate network keys in a predictable way based on their serial number, making it easy to guess or determine the network key." A key derived from something printed on the device is a key someone else can derive too.

2. The key traveled in the clear at pairing (CVE-2025-61738). Cleartext transmission of sensitive information, scored 5.3, Medium. CISA's text says "under specific circumstances" an attacker "can capture the network key." Chambers was more specific: "An attacker within radio reception range can also intercept the network keys whenever a device is paired to a PowerG network because the keys are sent to the pairing device in cleartext." In other words, the moment a sensor is enrolled is the moment the secret goes over the air.

3. Values meant to be used once were reused (CVE-2025-61739). Nonce reuse, scored 7.6, High. A nonce is a number used once; it's what stops an old encrypted message from being valid again. Chambers: "PowerG's cryptography also has a weakness where parameters that should only be used once are re-used every 36 hours (CVE-2025-61739). This means an attacker can replay captured messages every 36 hours without knowing the network keys, and potentially modify those replayed messages." If that sounds familiar, it's the same problem rolling codes on garage remotes were invented to solve: a recorded signal shouldn't work twice.

4. No proof of who's talking (CVE-2025-61740). Origin validation error, scored 7.6, High. CISA: the product "does not verify the source of a packet," which "could allow an attacker to create a denial-of-service condition or modify the configuration of the device." Chambers spelled out what that means once the keys are known: an attacker "can pretend to be any device on the network when sending messages; for example, they could pretend to be the main control panel sending configuration, or disarm, or unlock messages to peripherals. This results in a total loss of network security."

The lesson underneath: encryption isn't identity

Put the four together and the pattern is clear. The encryption itself wasn't the weak part. The weak parts were everything around it: where the key came from, when it moved, whether a value ever repeated, and whether a message had to prove its sender. Encryption keeps a stranger from reading the traffic. It does nothing to stop a stranger who has the key, and it doesn't by itself prove who sent a message. On a security network those are the properties that matter, because the messages that count are "armed," "disarmed," "open" and "unlock."

One detail stood out to me as an electronic warfare officer. Chambers notes that "the radio channel hopping sequence will also repeat every 36 hours." Frequency hopping is mostly an anti-jamming and anti-interference measure; it spreads a signal across channels so noise on one doesn't kill the link. It was never meant to be secrecy. A hop pattern that repeats on a schedule is one an observer can learn. That's the same reason I keep separating jamming a wireless alarm from breaking its cryptography: different attacks, different defenses, and a spec sheet that says "encrypted" or "frequency hopping" doesn't tell you how either one was done.

What CISA and Johnson Controls say to do

CISA states that "no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." That's worth keeping in proportion. Every attack described above needs someone within radio range of the house. It's a real flaw, not a remote mass-exploitation event.

The vendor's mitigations, from the revised Johnson Controls advisory and repeated in CISA's:

• "Prior to enrolling any devices," update IQ Panel 4 to version 4.6.1/4.6.1i or later.
• Devices that support PowerG+ should run PowerG v53.05 or later.
• During enrollment, enter the PIN code in the PIN Code field on the sensor enrollment screen.
• Only authorized company personnel or integrators should be present during installation, pairing and enrollment.
• If replacing a PowerG device, consider replacing end-of-life IQ Panel 2, IQ Panel 2+ and IQ Hub units with an IQ Panel on firmware 4.6.1 or later.

Note what the list implies. For IQ Panel 2, 2+ and IQ Hub, CISA lists every version as affected, and the vendor's path is replacement. Chambers said the same thing on record: "Mitigation requires updating device firmware where possible, and in some cases total replacement of the affected devices."

What I'd ask your installer

I help design the AI security systems for a veteran-owned (SDVOSB) home-security company run by fellow veterans. I do not own that company and earn nothing from this link. Full policy here. From that seat, these are the questions I'd want answered for any home with an IQ Panel:

• Which panel is it, and what firmware? IQ Panel 4 on 4.6.1 or later is the vendor's patched baseline. IQ Panel 2, 2+ or an IQ Hub is on the replace list.
• Were the sensors enrolled before or after the update? The vendor's wording is "prior to enrolling any devices," which suggests the order matters. If sensors were paired on old firmware, ask whether they should be re-enrolled. I couldn't confirm the answer from the advisories, so it's a question for the installer, not a claim from me.
• Was the PIN used at enrollment, and who was on site? Both are on the vendor's list. On a large property with staff and contractors, "who was within radio range when the sensors were paired" is a fair question.
• What does the alarm do besides PowerG? If the same network carries lock or disarm commands, the identity flaw matters more than it would on a system that only reports sensor trips.

What I could not confirm

NCC Group's full technical write-up. I didn't find or open a detailed research paper from NCC Group. The researcher's statements above come from his on-record quotes in SecurityBrief's coverage, which I read. The vulnerability list, scores and affected versions come from CISA and the vendor directly.

Whether the fixes close all four. CISA attaches the same mitigation list to all four CVEs. The revised vendor advisory lists all four in its header but its text describes only the cleartext key issue ("Johnson Controls has confirmed a vulnerability impacting PowerG IQ Panels"). I couldn't confirm from either document how each individual flaw is addressed by firmware.

How many homes. Neither advisory gives installed numbers. CISA lists deployment as worldwide.

Not my research. I didn't find or test these flaws. My published work is in microwave spectroscopy. Credit belongs to James Chambers and Sultan Qasim Khan of NCC Group, as CISA's acknowledgment states.

The signal

The PowerG flaws didn't break the encryption. They broke what encryption depends on: a key nobody can guess, a key that never crosses the air in the clear, values that never repeat, and proof of who sent a message. CISA rates three of the four high, reports no known exploitation, and every attack needs someone within radio range. If your home runs an IQ Panel, find out which model and which firmware. IQ Panel 4 on 4.6.1 or later is the vendor's patched line; IQ Panel 2, 2+ and IQ Hub are on its replacement list.