> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Johnson Controls EasyIO Neo Series EC and CW Controllers: Security Vulnerability Analysis
- URL: https://www.stirup.si/johnson-controls-easyio-neo-series-ec-and-cw-controllers-security-vuln-b39ff47a/
- Published: 2026-10-12T08:28:36.000Z
- Updated: 2026-10-12T08:28:36.000Z
- Description: This analysis examines the recently disclosed vulnerability in Johnson Controls' EasyIO Neo Series EC and CW Controllers, focusing on the exposure of sensitive information to unauthorized actors. The vulnerability affects specific firmware versions and highlights the importance of timely firmware up
- Author: Satish Das
- Tags: Security, Stirup Research

## Overview of the Vulnerability

The Johnson Controls EasyIO Neo Series EC and CW Controllers are programmable edge controllers used in building automation systems, supporting protocols such as BACnet and Modbus. A vulnerability has been identified in certain firmware versions, allowing an attacker to gain access to sensitive information that could be used for further attacks. The affected versions include EasyIO Neo Series EC Controllers V3.3b63 and V3.3b62, as well as CW Controllers V3.3b25 and V3.3b24\. The vulnerability is assigned the identifier CVE-2026-64892 and has a CVSS v3.1 score of 3.5 (LOW) and a CVSS v4.0 score of 4.8 (MEDIUM).

## Impact and Affected Sectors

The vulnerability is relevant to several critical infrastructure sectors, including Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy. These controllers are deployed globally, and the exposure of sensitive information could pose a risk to the security and integrity of building automation systems. The vulnerability is classified under CWE-200, which refers to the exposure of sensitive information to unauthorized actors.

## Remediation and Mitigation Strategies

Johnson Controls has released fixed firmware versions to address the vulnerability: EC firmware V3.3b64 and CW firmware V3.3b26\. Users are advised to upgrade to these versions as soon as operationally feasible. In the absence of immediate firmware updates, several mitigation strategies are recommended, including the implementation of physical access controls, network traffic monitoring, and the principle of least privilege for device interactions. Additionally, firmware updates that disable debug interfaces or require authentication before granting debug access are encouraged.

## Security Best Practices and Resources

CISA and Johnson Controls recommend following best practices outlined in the Johnson Controls Hardening Guide and the JCI Universal Hardening Guide. These resources provide detailed guidance on securing industrial control systems. Organizations are also advised to consult the ICS webpage on CISA's website for additional technical information and recommended practices. The Johnson Controls Trust Center Cybersecurity website offers access to the latest hardening guidelines and cybersecurity best practices.

## Conclusion

The vulnerability in the Johnson Controls EasyIO Neo Series EC and CW Controllers underscores the importance of maintaining up-to-date firmware and implementing robust security measures in industrial control systems. While the vulnerability is classified as low to medium severity, the potential for unauthorized access to sensitive information necessitates prompt action by users and administrators. Adhering to recommended mitigation strategies and firmware update procedures is essential to minimizing the risk of exploitation.

**Source:** [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.