Successful exploitation of this vulnerability, discovered by researcher Gabriele Gardois, could allow an attacker to gain access to sensitive information that could end up used to conduct further attacks against the system.
Johnson Controls EasyIO Neo Series EC and CW controllers are open, license-free programmable edge controllers used in building automation and management systems (BAS/BMS) to monitor and control HVAC, lighting, and energy equipment.
The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers suffer from the issue:
- EasyIO Neo Series EC Controllers V3.3b63
- EasyIO Neo Series EC Controllers V3.3b62
- EasyIO Neo Series CW Controllers V3.3b25
- EasyIO Neo Series CW Controllers V3.3b24
In the issue, Johnson Controls is aware of a vulnerability in EasyIO Neo Series EC and CW Controllers relating to an attacker gaining access to sensitive information that could be used to conduct further attacks against the system. The EC and CW are programmable edge controllers designed for building automation and control systems, used to manage and automate various building functions including HVAC, lighting, and energy management, supporting open protocols such as BACnet and Modbus for adaptable system connections.
CVE-2026-64892 is the case number for the vulnerability, which has a CVSS V3 base score of 3.5. There is also a V4 base score of 4.8.
Industrial Sectors
The product sees use in the critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy sectors. It also sees action on a global basis.
No exploit currently targets this vulnerability.
In terms of mitigations, Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. The fix is available in EC firmware V3.3b64 and CW firmware V3.3b26. Contact your Johnson Controls representative or authorized EasyIO distributor.
Before applying updates in production ICS/OT environments, users should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.
If immediate update is not possible, Johnson Controls recommends the following mitigations:
- Implement physical access controls to prevent unauthorized personnel from reaching device debug ports
- Monitor network traffic to and from affected devices for unusual or unauthorized access attempts
- Apply the principle of least privilege to all accounts and services that interact with the affected devices
- Where possible, apply firmware updates that disable debug interfaces or require authentication before granting debug access
- Implement intrusion detection/prevention systems to monitor for exploitation attempts
- Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide  .
These mitigations reduce risk but may not fully remediate the vulnerability. Users should update to the fixed versions when operationally feasible.