Johnson Controls EasyIO Neo Series Controllers Vulnerable to Cleartext Data Transmission

Johnson Controls has identified a vulnerability in the EasyIO Neo Series EC and CW Controllers that may allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network. The affected firmware versions include EasyIO Neo Series EC Controllers V3.3b62 and V3.3b63, and EasyIO Neo Series CW Controllers V3.3b24 and V3.3b25. Johnson Controls has released fixed versions: EC firmware V3.3b64 and CW firmware V3.3b26. The vulnerability stems from unencrypted HTTP communication and is mapped to CWE-319. No public exploit has been confirmed at the time of reporting. Johnson Controls recommends that users upgrade to the fixed versions as soon as operationally feasible and, in the interim, enforce HTTPS/TLS, disable HTTP access, place devices on segmented networks, and use VPNs for remote access. The company also advises reviewing logs and network telemetry for signs of unencrypted traffic or unauthorized management interface access. Advisory JCI-PSA-2026-30 provides further details.