Advisories › Johnson Controls › ICSA-26-279-01
Johnson Controls EasyIO FG: 2 CVEs, High 7.7
Summary
CISA reports 2 vulnerabilities in Johnson Controls EasyIO FG firmware. Weakness types: Use of Hard-coded Credentials, Improper Privilege Management. Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. Highest CVSS v3 score: 7.7 (High), not remotely exploitable per its CVSS vector.
What to do: Prioritize: Johnson Controls has determined that the EasyIO FG Series has reached End-of-Life (EOL) and End-of-Support (EOS) status. The product has not been manufactured or sold since prior to 2019, and the source code is no longer available.
At a glance
- Vendor
- Johnson Controls
- Products
- EasyIO FG firmware
- CVEs
- CVE-2026-27872, CVE-2026-27873
- Highest CVSS v3
- 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-27872 | Use of Hard-coded Credentials | 7.7 | – | No | A vulnerability exists in EasyIO FG relating to an attacker gaining unauthorized access to the system through hard-coded credentials and improper privilege management, potentially resulting in full device compromise. Successful exploitation could result in technical or operational impact. |
| CVE-2026-27873 | Improper Privilege Management | 7.7 | – | No | A vulnerability exists in EasyIO FG relating to an attacker gaining unauthorized access to the system through hard-coded credentials and improper privilege management, potentially resulting in full device compromise. Successful exploitation could result in technical or operational impact. |
Affected products (1)
- Johnson Controls EasyIO FG firmware: <=2.0b52
Vendor fixes and mitigations (from advisory)
- Mitigation: Johnson Controls has determined that the EasyIO FG Series has reached End-of-Life (EOL) and End-of-Support (EOS) status. The product has not been manufactured or sold since prior to 2019, and the source code is no longer available. As a result, no firmware patch or code-level fix will be issued. Users are advised to migrate to supported current-generation products (e.g., EasyIO Neo R1 Series).
- Mitigation: Deploy devices only within isolated BAS/OT networks
- Mitigation: Ensure no direct Internet exposure
- Mitigation: Enforce strict VLAN segmentation from enterprise IT networks
- Mitigation: Restrict access to trusted engineering workstations only
- Mitigation: Block all remote login access from untrusted networks
- Mitigation: Allow connections only from whitelisted IP addresses
- Mitigation: Block all Internet-originated traffic
- Mitigation: Prevent unauthorized lateral movement across networks
- Mitigation: Restrict communication to required protocols only
- Mitigation: Disable insecure services (e.g., Telnet), if enabled
- Mitigation: Disable any unnecessary services or exposed ports
- Mitigation: Monitor for repeated login attempts
- Mitigation: Monitor for unauthorized or root-level access
- Mitigation: Enable logging and centralized monitoring (where supported)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.