Our takeCISA warns that Johnson Controls EasyIO Neo EC and CW controllers V3.3b62 and V3.3b63 contain flaws that let attackers intercept credentials and session data. Update to a fixed version if you run them.Cyber Resilience desk
What this means for you — Security leader:CISA reports two vulnerabilities in Johnson Controls EasyIO Neo Series EC and CW Controllers (V3.3b62–V3.3b63) that let attackers intercept credentials and session data or access other sensitive information. Update to a fixed version immediately if you operate these controllers.
What this means for you — Lean IT orgs:If you use Johnson Controls EasyIO Neo Series EC or CW Controllers, check the version and update to the latest fixed release right away. An attacker who reaches the device could steal credentials or session data.
What this means for you — MSP:Check client environments for Johnson Controls EasyIO Neo Series EC/CW Controllers running V3.3b62 or V3.3b63 and apply the vendor fix. The flaws allow interception of credentials and session data.
What this means for you — Researcher:CISA published two ICS advisories for Johnson Controls EasyIO Neo Series controllers disclosing information-disclosure flaws (CVE-2026-64892 and CVE-2026-64893) in V3.3b62–V3.3b63.