Advisories › Johnson Controls › ICSA-26-274-04
Johnson Controls EasyIO Neo Series EC and CW Controllers: 1 CVE, Low 3.5
Summary
CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. Highest CVSS v3 score: 3.5 (Low), exploitable over the network.
What to do: Plan: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. The fix is available in EC firmware V3.3b64 and CW firmware V3.3b26.
At a glance
- Vendor
- Johnson Controls
- Products
- EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers
- CVEs
- CVE-2026-64892
- Highest CVSS v3
- 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-64892 | Exposure of Sensitive Information to an Unauthorized Actor | 3.5 | – | No | Johnson Controls is aware of a vulnerability in EasyIO Neo Series EC and CW Controllers relating to an attacker gaining access to sensitive information that could be used to conduct further attacks against the system. The EC and CW are programmable edge controllers designed for building automation and control systems, used to manage and automate various building functions including HVAC, lighting,… |
Affected products (4)
- Johnson Controls EasyIO Neo Series EC Controllers: V3.3b63
- Johnson Controls EasyIO Neo Series EC Controllers: V3.3b62
- Johnson Controls EasyIO Neo Series CW Controllers: V3.3b25
- Johnson Controls EasyIO Neo Series CW Controllers: V3.3b24
Vendor fixes and mitigations (from advisory)
- Mitigation: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. The fix is available in EC firmware V3.3b64 and CW firmware V3.3b26. Contact your Johnson Controls representative or authorized EasyIO distributor.
- Mitigation: Before applying updates in production ICS/OT environments, users should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.
- Mitigation: If immediate update is not possible, Johnson Controls recommends the following mitigations: Implement physical access controls to prevent unauthorized personnel from reaching device debug ports. Monitor network traffic to and from affected devices for unusual or unauthorized access attempts. Apply the principle of least privilege to all accounts and services that interact with the affected devices. Where possible, apply firmware updates that disable debug interfaces or require authentication before granting debug access. Implement intrusion detection/prevention systems to monitor for exploitat link
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-20.https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-274-04
- Machine-readable CSAF record
- https://www.johnsoncontrols.com/trust-center/cybersecurity/resources
- https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.