Successful exploitation of these vulnerabilities, discovered by Gabriele Gardois, Zachary Bushell and Lorenzo De Carli of the University of Calgary in Canada, could allow an attacker to gain full unauthorized access to the device.
Johnson Controls EasyIO FG is a legacy series of 32-point IP-based building energy management and automation controllers (such as the FG-32+) designed to monitor and control HVAC and building systems.
The following versions of Johnson Controls EasyIO FG suffer from the vulnerabilities: EasyIO FG firmware up to and including version 2.0b52.
In one issue, a vulnerability exists in EasyIO FG relating to an attacker gaining unauthorized access to the system through hard-coded credentials and improper privilege management, potentially resulting in full device compromise. Successful exploitation could result in technical or operational impact.
CVE-2026-27872 is the case number for the vulnerability, which has a CVSS V3 base score of 7.7. There is also a V4 base score of 7.2.
Another Vulnerability
Additionally, a vulnerability exists in EasyIO FG relating to an attacker gaining unauthorized access to the system through hard-coded credentials and improper privilege management, potentially resulting in full device compromise. Successful exploitation could result in technical or operational impact.
CVE-2026-27873 is the case number for the vulnerability, which has a CVSS V3 base score of 7.7. There is also a V4 base score of 7.2.
The product sees use in the critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy sectors. It also sees action on a global basis.
There are no exploits currently targeting these vulnerabilities. These vulnerabilities have a high attack complexity and they are not remotely exploitable.
In terms of mitigations, Johnson Controls determined the EasyIO FG Series has reached End-of-Life (EOL) and End-of-Support (EOS) status. The company has not manufactured or sold the product since prior to 2019, and the source code is no longer available. As a result, there will be no firmware patch or code-level fix. Instead, users should migrate to supported current-generation products (e.g., EasyIO Neo R1 Series).
Best Practices
Johnson Controls did suggest some mitigation best practices:
- Deploy devices only within isolated BAS/OT networks
- Ensure no direct Internet exposure
- Enforce strict VLAN segmentation from enterprise IT networks
- Restrict access to trusted engineering workstations only
- Block all remote login access from untrusted networks
- Allow connections only from whitelisted IP addresses
- Block all Internet-originated traffic
- Prevent unauthorized lateral movement across networks
- Restrict communication to required protocols only
- Disable insecure services (e.g., Telnet), if enabled
- Disable any unnecessary services or exposed ports
- Monitor for repeated login attempts
- Monitor for unauthorized or root-level access
- Enable logging and centralized monitoring (where supported)
- Restrict distribution of firmware images
- Prevent unauthorized physical and console access
For more detailed mitigation instructions, click on Johnson Controls Product Security Advisory JCI-PSA-2026-12.