Johnson Controls EasyIO Neo Series EC and CW Controllers
Johnson Controls EasyIO controllers vulnerable to cleartext transmission of sensitive information.
A vulnerability (CVE-2026-64893) has been identified in Johnson Controls EasyIO Neo Series EC and CW Controllers, versions prior to V3.3b64 (EC) and V3.3b26 (CW). Successful exploitation could allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network. Johnson Controls has released updated firmware to address the issue and recommends immediate upgrades, along with several mitigation strategies for environments where immediate patching is not feasible.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Johnson Controls?
Get an email when a new story names Johnson Controls, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonJohnson Controls EasyIO Neo Series EC and CW Controllers, prior to firmware versions V3.3b64 and V3.3b26 respectively, transmitted sensitive data — including credentials and session tokens — in cleartext over the network, exposing them to interception via passive eavesdropping or man-in-the-middle attacks. The root cause is a failure to enforce encrypted communications (such as TLS) at the firmware level in industrial control system (ICS) hardware. This is particularly critical in operational technology (OT) environments where compromised credentials can lead to unauthorized control of physical systems. The vendor has released patched firmware, but the window between discovery and deployment leaves unpatched devices acutely vulnerable, especially if they are network-accessible.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-64893