Johnson Controls ICS Controllers Transmit Credentials in Cleartext
Written by AI from the linked story. Not reviewed by an editor. How this works
Johnson Controls EasyIO Neo Series EC and CW Controllers, prior to firmware versions V3.3b64 and V3.3b26 respectively, transmitted sensitive data — including credentials and session tokens — in cleartext over the network, exposing them to interception via passive eavesdropping or man-in-the-middle attacks. The root cause is a failure to enforce encrypted communications (such as TLS) at the firmware level in industrial control system (ICS) hardware. This is particularly critical in operational technology (OT) environments where compromised credentials can lead to unauthorized control of physical systems. The vendor has released patched firmware, but the window between discovery and deployment leaves unpatched devices acutely vulnerable, especially if they are network-accessible.
Tactical Insight
Immediate Actions
- Upgrade affected EC controllers to firmware V3.3b64 and CW controllers to V3.3b26 or later without delay.
- Isolate vulnerable controllers from untrusted networks using firewalls or VLANs until patching is complete.
- Rotate all credentials and invalidate active sessions on affected devices as a precautionary measure.
Long-Term Improvements
- Enforce encrypted communications (TLS/HTTPS) as a baseline requirement for all OT/ICS device procurement and configuration standards.
- Maintain a complete, up-to-date firmware inventory for all industrial controllers and automate alerts for newly published CVEs against those assets.
- Implement a formal OT patch management policy with defined SLAs for critical-severity vulnerabilities.
Detection Measures
- Deploy network traffic analysis tools capable of detecting cleartext credential transmission across OT network segments.
- Enable centralized logging of authentication events on ICS devices and alert on anomalous login patterns or session activity.
- Conduct regular passive network scans of OT environments to identify unencrypted protocol usage.