Johnson Controls EasyIO Neo Series EC and CW Controllers

Johnson Controls warns of two controllers vulnerable to sensitive information disclosure.
Affected versions must be evaluated for risk immediately and protected according to the vendor's hardening guidelines.

Key points

Check EC/CW controller firmware to confirm if it is running affected versions such as V3.3b63/62/b25/b24.
Attackers can steal sensitive information to launch subsequent system attacks; unauthorized access must be blocked as a priority.
Apply the vendor's hardening guidelines and implement defense-in-depth strategies to reduce the risk of industrial control systems being exploited.

What to do next

Immediately visit the Johnson Controls Trust Center to download and deploy the latest hardening guidelines.
Monitor internal networks for anomalous traffic; report any suspected malicious activity following established procedures to CISA for tracking.

View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system.

The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected:

EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892)
EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892)
EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892)
EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64892)

CVSS

Vendor

Equipment

Vulnerabilities

v3 3.5

Johnson Controls

Johnson Controls EasyIO Neo Series EC and CW Controllers

Exposure of Sensitive Information to an Unauthorized Actor

Background

Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Ireland

Vulnerabilities

Expand All +

CVE-2026-64892

Johnson Controls is aware of a vulnerability in EasyIO Neo Series EC and CW Controllers relating to an attacker gaining access to sensitive information that could be used to conduct further attacks against the system. The EC and CW are programmable edge controllers designed for building automation and control systems, used to manage and automate various building functions including HVAC, lighting, and energy management, supporting open protocols such as BACnet and Modbus for adaptable system connections.

View CVE Details

Affected Products

Johnson Controls EasyIO Neo Series EC and CW Controllers

Vendor:
Johnson Controls

Product Version:
Johnson Controls EasyIO Neo Series EC Controllers: V3.3b63, Johnson Controls EasyIO Neo Series EC Controllers: V3.3b62, Johnson Controls EasyIO Neo Series CW Controllers: V3.3b25, Johnson Controls EasyIO Neo Series CW Controllers: V3.3b24

Product Status:
known_affected

Relevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Metrics

CVSS Version

Base Score

Base Severity

Vector String

3.1

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L

4.0

4.8

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Acknowledgments

Gabriele Gardois reported this vulnerability to Johnson Controls

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

The recommendations provided within Johnson Controls Hardening Guide should always be applied to minimize security risk. Visit the Johnson Controls Trust Center Cybersecurity website to access the latest Hardening Guidelines and cybersecurity best practices - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories .

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

Initial Release Date: 2026-10-01

Date

Revision

Summary

2026-10-01

Initial Republication of Johnson Controls Product Security Advisory JCI-PSA-2026-20