CISA Advises of Sensitive Information Exposure in Johnson Controls EasyIO Neo Series Controllers

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-274-04 on 1 October 2026, detailing a vulnerability in Johnson Controls EasyIO Neo Series EC and CW Controllers. According to the advisory, successful exploitation could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system.

The affected products include EasyIO Neo Series EC Controllers running firmware versions V3.3b63 and V3.3b62, and EasyIO Neo Series CW Controllers running firmware versions V3.3b25 and V3.3b24. All four versions are listed as known_affected.

Johnson Controls attributes the vulnerability to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The controllers are programmable edge devices designed for building automation and control systems, used to manage and automate various building functions including HVAC, lighting, and energy management. They support open protocols such as BACnet and Modbus for adaptable system connections.

The vulnerability was reported to Johnson Controls by researcher Gabriele Gardois. CVSS scoring includes version 3.1 with a base score of 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L) and version 4.0 with a base score of 4.8 (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N), categorizing the severity from low to medium.

Johnson Controls has released fixed firmware versions: EC firmware V3.3b64 and CW firmware V3.3b26. Users are advised to upgrade to the fixed version or later as soon as operationally feasible. Before applying updates in ICS/OT environments, organizations should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.

If immediate update is not possible, Johnson Controls recommends implementing physical access controls to prevent unauthorized personnel from reaching device debug ports, monitoring network traffic to and from affected devices for unusual or unauthorized access attempts, applying the principle of least privilege to all accounts and services that interact with the affected devices, and where possible, applying firmware updates that disable debug interfaces or require authentication before granting debug access. Additional mitigations include deploying intrusion detection/prevention systems and following the product hardening guide available on the Johnson Controls Trust Center Cybersecurity website.