Johnson Controls EasyIO Neo Series EC and CW Controllers

Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data.

The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected:

EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893)

EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893)

EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893)

EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)

Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Ireland

Johnson Controls is aware of a vulnerability in EasyIO Neo which may allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network. Successful exploitation could result in technical or operational impact. EasyIO Neo is a programmable building automation edge controller used to manage and automate HVAC, lighting, and energy systems in commercial buildings through a web-based interface.

Mitigation Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. HTTP communication has been disabled by default in the latest version. The fix is available in EC firmware V3.3b64 andCW firmware V3.3b26. your Johnson Controls representative or visitthe Johnson Controls Trust Center.

Mitigation Before applying updates in production ICS/OT environments, users should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.

Mitigation If immediate update is not possible, Johnson Controls recommends the following mitigations:

Enable and enforce HTTPS/TLS for all web-based management access to the device.

Disable HTTP access entirely.

Place devices on an isolated, segmented network behind a firewall to limit exposure of management interfaces.

Use a VPN when accessing devices remotely to encrypt all traffic in transit.

Monitor network traffic for unencrypted sensitive data leaving the management interface.

Restrict network access to management interfaces using access control lists (ACLs) to only trusted hosts. Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide found here: .

These mitigations reduce risk but may not fully remediate the vulnerability. Users should update to the fixed versions when operationally feasible.

Mitigation Users should review logs, network telemetry, device events, and security monitoring tools for activity involving EasyIO NEO versions EC and CW. Relevant detection information may include: Unencrypted HTTP traffic to or from the device management interface on port 80. Network captures showing cleartext credentials or session tokens in HTTP requests. Unexpected devices or IP addresses accessing the web management console. ARP spoofing or other man-in-the-middle indicators on the local network segment. Unauthorized configuration changes that may indicate credential interception.

Mitigation The recommendations provided within Johnson Controls Hardening Guide should always be applied to minimize security risk. Visit the Johnson Controls Trust Center Cybersecurity website to access the latest Hardening Guidelines and cybersecurity best practices -

Mitigation For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-30.

Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information

Gabriele Gardois reported this vulnerability to Johnson Controls

Legal Notice and Terms of Use

This product is provided subject to this Notification ( ) and this Privacy & Use policy ( ).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

Initial Release Date: 2026-10-01

Legal Notice and Terms of Use

This product is provided subject to this Notification and this Privacy & Use policy.

Johnson Controls, Inc