Advisories › Johnson Controls › ICSA-26-274-05
Johnson Controls EasyIO Neo Series EC and CW Controllers: 1 CVE, Medium 5.4
Summary
CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Cleartext Transmission of Sensitive Information. Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. Highest CVSS v3 score: 5.4 (Medium), exploitable over the network.
What to do: Plan: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible.
At a glance
- Vendor
- Johnson Controls
- Products
- EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers
- CVEs
- CVE-2026-64893
- Highest CVSS v3
- 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-64893 | Cleartext Transmission of Sensitive Information | 5.4 | – | No | Johnson Controls is aware of a vulnerability in EasyIO Neo which may allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network. Successful exploitation could result in technical or operational impact. EasyIO Neo is a programmable building automation edge controller used to manage and automate HVAC, lighting, and… |
Affected products (4)
- Johnson Controls EasyIO Neo Series EC Controllers: V3.3b62
- Johnson Controls EasyIO Neo Series EC Controllers: V3.3b63
- Johnson Controls EasyIO Neo Series CW Controllers: V3.3b24
- Johnson Controls EasyIO Neo Series CW Controllers: V3.3b25
Vendor fixes and mitigations (from advisory)
- Mitigation: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. HTTP communication has been disabled by default in the latest version. The fix is available in EC firmware V3.3b64 andCW firmware V3.3b26. Contact your Johnson Controls representative or visitthe Johnson Controls Trust Center.
- Mitigation: Before applying updates in production ICS/OT environments, users should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.
- Mitigation: If immediate update is not possible, Johnson Controls recommends the following mitigations: Enable and enforce HTTPS/TLS for all web-based management access to the device. Disable HTTP access entirely. Place devices on an isolated, segmented network behind a firewall to limit exposure of management interfaces. Use a VPN when accessing devices remotely to encrypt all traffic in transit. Monitor network traffic for unencrypted sensitive data leaving the management interface. Restrict network access to management interfaces using access control lists (ACLs) to only trusted hosts. Refer to and fol link
- Mitigation: Users should review logs, network telemetry, device events, and security monitoring tools for activity involving EasyIO NEO versions EC and CW. Relevant detection information may include: Unencrypted HTTP traffic to or from the device management interface on port 80. Network captures showing cleartext credentials or session tokens in HTTP requests. Unexpected devices or IP addresses accessing the web management console. ARP spoofing or other man-in-the-middle indicators on the local network segment. Unauthorized configuration changes that may indicate credential interception.
- Mitigation: The recommendations provided within Johnson Controls Hardening Guide should always be applied to minimize security risk. Visit the Johnson Controls Trust Center Cybersecurity website to access the latest Hardening Guidelines and cybersecurity best practices - https://www.johnsoncontrols.com/trust-center/cybersecurity/resources. link
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-30.https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.