The Cybersecurity and Infrastructure Security Agency published an advisory on October 1 warning that a vulnerability in Johnson Controls EasyIO Neo Series EC and CW controllers could expose sensitive information to an unauthorized attacker. The disclosed issue is tracked as CVE-2026-64892 and could provide information that supports further attacks against affected systems, CISA said.
The affected firmware versions are EC Controllers V3.3b62 and V3.3b63, along with CW Controllers V3.3b24 and V3.3b25. CISA identifies the flaw as CWE-200, or exposure of sensitive information to an unauthorized actor. The advisory assigns the vulnerability a CVSS 3.1 base score of 3.5, rated low, while its CVSS 4.0 score is 4.8, rated medium.
Johnson Controls has released firmware updates for both controller families. The remediation is EC firmware V3.3b64 for the EC series and CW firmware V3.3b26 for the CW series. CISA and Johnson Controls advise users to upgrade to the applicable fixed version or later as soon as operationally feasible. Customers are directed to contact a Johnson Controls representative or an authorized EasyIO distributor to obtain the fix.
The EasyIO Neo EC and CW devices are programmable edge controllers used in building automation and control systems. CISA describes their functions as including management and automation of HVAC, lighting, and energy systems. The controllers support open protocols such as BACnet and Modbus, allowing them to connect with other systems used in building operations. The advisory lists the affected products as deployed worldwide and identifies critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy among the sectors where the products are used.
The published CVSS 3.1 vector indicates that exploitation is possible over a network but requires high privileges and user interaction. It assigns a low impact to confidentiality, with no impact to integrity and a low impact to availability. The advisory does not report known public exploitation specifically targeting this vulnerability, and it identifies Gabriele Gardois as the person who reported the issue to Johnson Controls.
Organizations applying the updates in production industrial-control or operational-technology environments should assess operational impact, back up relevant configurations, test the firmware in a non-production setting where feasible, and follow established change-management and safety procedures. CISA also recommends performing impact analysis and risk assessment before deploying defensive measures.
If an immediate firmware update is not possible, Johnson Controls recommends controlling physical access to device debug ports, monitoring traffic to and from affected controllers, and applying least privilege to accounts and services that interact with them. It also recommends intrusion-detection or prevention controls and, where possible, firmware configurations that disable debug interfaces or require authentication before debug access is granted.
Those interim measures may reduce exposure but do not fully remediate the vulnerability. Users should follow the detailed instructions in Johnson Controls Product Security Advisory JCI-PSA-2026-20 and the company’s hardening guidance, then move to the fixed firmware when operationally feasible. CISA encourages organizations to apply recommended cybersecurity practices for industrial control systems and to report suspected malicious activity through established procedures.