One Hardcoded Key, Many Systems at Risk: The Johnson Controls Airwall Lesson

A hardcoded cryptographic key can look like a relatively simple implementation mistake. In an embedded or industrial system, however, that single decision can undermine an entire security architecture.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine CVE-2026-64887 affecting Johnson Controls Airwall and use it to explore a broader problem in embedded cybersecurity: what happens when a secret intended to establish trust is permanently built into the product itself. Airwall versions before 4.1 contain a hardcoded cryptographic key that can enable a cryptanalytic attack, exposing a weakness in a platform designed to provide identity-based, zero-trust protection for connected operational assets.The Technical Breakdown looks beyond the vulnerability label to examine why hardcoded secrets are fundamentally different from ordinary credentials. A password can be changed and a certificate can be replaced, but a cryptographic key embedded across deployed products may be shared by many installations and deeply coupled to firmware, configuration data or authentication mechanisms. Once that secret is discovered, the problem is no longer confined to a single device. The trust model built around it must be reassessed.The Operational Decisions explore what remediation really means in an industrial environment. Updating software may remove the vulnerable implementation, but organisations still need to determine where affected versions are deployed, what information may have been exposed, whether the same secret existed across multiple installations and whether systems that previously relied on that key can still be trusted. Asset visibility, supplier coordination, maintenance windows and operational continuity quickly become part of what initially looked like a cryptographic problem.In The Pressure Test, you are responsible for cybersecurity in a large automotive manufacturing environment where embedded systems support high-speed robotic processes. A hardcoded-key vulnerability is disclosed in technology connected to the operational environment, but production cannot simply stop while every dependency is investigated. You must decide what to isolate, what can continue operating, how to establish the affected population and what evidence is necessary before declaring the environment trustworthy again.The key lesson is that cryptographic strength means very little if key management is weak. Secure algorithms cannot compensate for secrets that are identical across deployments, impossible to rotate or permanently embedded in software. Effective product and OT cybersecurity therefore requires unique secrets, protected provisioning, controlled key lifecycle management, revocation and rotation mechanisms, and clear evidence that compromise of one device cannot automatically undermine every other deployment.Because the most sophisticated security architecture can still depend on one very simple question: who else knows the key?Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders.Explore all episodes and resources:https://cybersecurityunderpressure.com/episodes