[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd7WVQXHGebdEVIldzvyyGY0l5xzPHJ6Ls_R5L8JkGo8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"8f35e91f-0316-43bc-9c6f-89c0c247fea3","johnson-controls-ics-controllers-transmit-credentials-in-cleartext","01019f25-64f0-4cbe-814c-447106290ee3","Johnson Controls ICS Controllers Transmit Credentials in Cleartext","Johnson Controls EasyIO Neo Series EC and CW Controllers, prior to firmware versions V3.3b64 and V3.3b26 respectively, transmitted sensitive data — including credentials and session tokens — in cleartext over the network, exposing them to interception via passive eavesdropping or man-in-the-middle attacks. The root cause is a failure to enforce encrypted communications (such as TLS) at the firmware level in industrial control system (ICS) hardware. This is particularly critical in operational technology (OT) environments where compromised credentials can lead to unauthorized control of physical systems. The vendor has released patched firmware, but the window between discovery and deployment leaves unpatched devices acutely vulnerable, especially if they are network-accessible.","**Immediate Actions:**\n- Upgrade affected EC controllers to firmware V3.3b64 and CW controllers to V3.3b26 or later without delay.\n- Isolate vulnerable controllers from untrusted networks using firewalls or VLANs until patching is complete.\n- Rotate all credentials and invalidate active sessions on affected devices as a precautionary measure.\n\n**Long-Term Improvements:**\n- Enforce encrypted communications (TLS\u002FHTTPS) as a baseline requirement for all OT\u002FICS device procurement and configuration standards.\n- Maintain a complete, up-to-date firmware inventory for all industrial controllers and automate alerts for newly published CVEs against those assets.\n- Implement a formal OT patch management policy with defined SLAs for critical-severity vulnerabilities.\n\n**Detection Measures:**\n- Deploy network traffic analysis tools capable of detecting cleartext credential transmission across OT network segments.\n- Enable centralized logging of authentication events on ICS devices and alert on anomalous login patterns or session activity.\n- Conduct regular passive network scans of OT environments to identify unencrypted protocol usage.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 3: Data Protection","NIST SP 800-82: Guide to ICS Security","NIST SC-8: Transmission Confidentiality and Integrity","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","IEC 62443-3-3: SR 4.1 Information Confidentiality","GDPR Article 32: Security of Processing (where PII may be exposed)","ITIL Change Management: Emergency Change Procedures",{},"published","2026-10-01T18:22:53.481625+00:00","2026-10-01T18:22:52.992+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-274-05","johnson-controls-easyio-neo-series-ec-and-cw-controllers-af342d","Johnson Controls EasyIO Neo Series EC and CW Controllers",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[51,54,58],{"slug":34,"name":52,"problem":53},"Automated patch management","Known holes get closed in days, not months.",{"slug":55,"name":56,"problem":57},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",{"slug":59,"name":60,"problem":61},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]