Johnson Controls EasyIO Neo Series EC and CW Controllers: Security Vulnerability Analysis

Overview of the Vulnerability

The Johnson Controls EasyIO Neo Series EC and CW Controllers are programmable building automation edge controllers used to manage HVAC, lighting, and energy systems in commercial buildings. These devices rely on a web-based interface for configuration and management. However, a vulnerability has been identified in certain firmware versions that allows for the cleartext transmission of sensitive information, including credentials and session data, over the network.

Affected Versions and Risk

The vulnerability, identified as CVE-2026-64893, affects the following versions of the EasyIO Neo controllers:

• EasyIO Neo Series EC Controllers V3.3b62
• EasyIO Neo Series EC Controllers V3.3b63
• EasyIO Neo Series CW Controllers V3.3b24
• EasyIO Neo Series CW Controllers V3.3b25

According to the CVSS v3.1 score, the vulnerability has a base severity of medium with a score of 5.4. This indicates that while the vulnerability is not trivial to exploit, it could still result in significant operational or technical impact if successfully exploited.

Impact and Potential Exploitation

Successful exploitation of this vulnerability could allow an attacker to intercept and read sensitive information transmitted in cleartext over the network. This includes credentials and session data, which could be used to gain unauthorized access to the device's management interface. The potential for unauthorized configuration changes or operational disruption is a concern for critical infrastructure sectors such as energy, transportation, and commercial facilities.

Remediation and Mitigation Strategies

Johnson Controls has released fixed versions of the firmware to address this vulnerability. The recommended remediation is to upgrade to the fixed versions, which include EC firmware V3.3b64 and CW firmware V3.3b26. These versions disable HTTP communication by default, reducing the risk of cleartext transmission.

For organizations unable to immediately apply the firmware update, several mitigation strategies are recommended:

• Enable and enforce HTTPS/TLS for all web-based management access.
• Disable HTTP access entirely.
• Isolate devices on a segmented network behind a firewall.
• Use a VPN for remote access to encrypt traffic in transit.
• Implement access control lists (ACLs) to restrict network access to trusted hosts.

These steps aim to reduce the risk of exploitation but may not fully eliminate the vulnerability. Organizations are advised to follow the Johnson Controls Hardening Guide and review logs, network telemetry, and security monitoring tools for suspicious activity.

Considerations for Implementation

Before applying updates in production environments, users should review the operational impact, back up configurations, and test updates in non-production settings where feasible. Adherence to change-management and safety procedures is essential to ensure stability and minimize disruption.

Organizations should also refer to the Johnson Controls Trust Center for additional resources, including the JCI universal hardening guide and cybersecurity best practices. The full details of the vulnerability and mitigation steps are available in the Johnson Controls Product Security Advisory JCI-PSA-2026-30.

Source: CISA. Analysis based on publicly available information; no hands-on testing is claimed.