Our takeCISA reports two flaws in Johnson Controls EasyIO Neo EC and CW controllers that let attackers intercept credentials and session data. Update to a fixed version if you run these OT controllers.Cyber Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA reports two vulnerabilities in Johnson Controls EasyIO Neo Series EC and CW Controllers (CVE-2026-64892, CVE-2026-64893) that can expose sensitive information and credentials. Update to a fixed version if you operate these OT/ICS devices.
What this means for you — Lean IT orgs:If you use Johnson Controls EasyIO Neo Series EC or CW Controllers, check the version and update immediately. These flaws let attackers read sensitive data and credentials.
What this means for you — MSP:Advise clients running Johnson Controls EasyIO Neo Series EC/CW Controllers (V3.3b62–b63) to apply the vendor fix. The issues allow interception of credentials and session data.
What this means for you — Researcher:CISA published two ICS advisories for Johnson Controls EasyIO Neo Series controllers exposing sensitive information and credentials via CVE-2026-64892 and CVE-2026-64893.