Critical Vulnerabilities Discovered in Johnson Controls EasyIO FG Firmware; Product Reaches End-of-Life

Johnson Controls EasyIO FG firmware versions 2.0b52 and below are affected by two vulnerabilities tracked as CVE-2026-27872 and CVE-2026-27873. According to the joint CISA and Johnson Controls advisory (ICSA-26-279-01), the vulnerabilities involve the use of hard-coded credentials and improper privilege management. Successful exploitation could allow an attacker to gain full unauthorized access to the device, resulting in technical or operational impact in OT and Building Automation System environments.

Johnson Controls has determined that the EasyIO FG Series has reached End-of-Life (EOL) and End-of-Support (EOS) status. The product has not been manufactured or sold since prior to 2019, and the source code is no longer available. As a result, no firmware patch or code-level fix will be issued. The vendor advises users to migrate to supported current-generation products, such as the EasyIO Neo R1 Series.

Because no patch is available, the advisory provides extensive compensatory mitigation guidance. Key recommendations include: deploying devices only within isolated BAS/OT networks; ensuring no direct Internet exposure; enforcing strict VLAN segmentation from enterprise IT networks; restricting access to trusted engineering workstations only; blocking all remote login access from untrusted networks; allowing connections only from whitelisted IP addresses; blocking all Internet-originated traffic; preventing unauthorized lateral movement across networks; restricting communication to required protocols only; disabling insecure services such as Telnet; disabling any unnecessary services or exposed ports; monitoring for repeated login attempts; monitoring for unauthorized or root-level access; enabling logging and centralized monitoring (where supported); restricting distribution of firmware images; and preventing unauthorized physical and console access.

The vulnerabilities are assigned CVSS scores of 7.7 (HIGH) and 7.2 (HIGH). Relevant CWEs include CWE-798 (Use of Hard-coded Credentials). Affected sectors include Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy. The product is deployed worldwide.