Successful exploitation of this vulnerability, discovered by researcher Gabriele Gardois, could allow an attacker to intercept and read sensitive information, including credentials and session data.
Johnson Controls EasyIO Neo Series consists of open, license-free, programmable edge controllers designed for building automation and control systems (BMS) to manage and automate HVAC, lighting, and energy management.
Meanwhile, CW Controllers are right-sized, flexible edge controllers for small applications or distributed/wireless setups. EC Controllers are for larger plant-level or IP-backbone deployments, managing up to 90 devices and 3,000 points.
The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers suffer from the issue:
- EasyIO Neo Series EC Controllers V3.3b62
- EasyIO Neo Series EC Controllers V3.3b63
- EasyIO Neo Series CW Controllers V3.3b24
- EasyIO Neo Series CW Controllers V3.3b25
Vulnerability
Johnson Controls is aware of a vulnerability in EasyIO Neo which may allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network. Successful exploitation could result in technical or operational impact. EasyIO Neo is a programmable building automation edge controller used to manage and automate HVAC, lighting, and energy systems in commercial buildings through a web-based interface.
CVE-2026-64893 is the case number for the vulnerability, which has a CVSS V3 base score of 5.4. There is also a V4 base score of 5.9.
The product sees use in the critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy sectors.
No exploit currently targets this vulnerability. Additionally, This vulnerability has a high attack complexity.
In terms of mitigations, Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. HTTP communication ended up disabled by default in the latest version. The fix is available in EC firmware V3.3b64 andCW firmware V3.3b26. Contact your Johnson Controls representative or visitthe Johnson Controls Trust Center.
Before applying updates in production ICS/OT environments, users should review operational impact, backup relevant configurations, test updates in a non-production environment where feasible, and follow applicable change-management and safety procedures.
Mitigations
If immediate update is not possible, Johnson Controls recommends the following mitigations:
- Enable and enforce HTTPS/TLS for all web-based management access to the device.
- Disable HTTP access entirely.
- Place devices on an isolated, segmented network behind a firewall to limit exposure of management interfaces.
- Use a VPN when accessing devices remotely to encrypt all traffic in transit.
- Monitor network traffic for unencrypted sensitive data leaving the management interface.
- Restrict network access to management interfaces using access control lists (ACLs) to only trusted hosts. Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide. Â .
Furthermore, users should review logs, network telemetry, device events, and security monitoring tools for activity involving EasyIO NEO versions EC and CW. Relevant detection information may include:
- Unencrypted HTTP traffic to or from the device management interface on port 80
- Network captures showing cleartext credentials or session tokens in HTTP requests.
- Unexpected devices or IP addresses accessing the web management console
- ARP spoofing or other man-in-the-middle indicators on the local network segment
- Unauthorized configuration changes that may indicate credential interception.
You can apply the recommendations provided within Johnson Controls Hardening Guide to minimize security risk. Click on the Johnson Controls Trust Center Cybersecurity website to access the latest Hardening Guidelines and cybersecurity best practices.
Click on Johnson Controls Product Security Advisory JCI-PSA-2026-30 for more detailed mitigation instructions.