The Cybersecurity and Infrastructure Security Agency has issued an advisory for a vulnerability in Johnson Controls EasyIO Neo Series EC and CW building automation controllers that could expose credentials and session data transmitted over a network. The flaw, tracked as CVE-2026-64893, affects specific firmware versions and carries a medium-severity CVSS 3.1 score of 5.4.
The affected EC versions are V3.3b62 and V3.3b63. The affected CW versions are V3.3b24 and V3.3b25. CISA identifies the issue as CWE-319, or cleartext transmission of sensitive information. Johnson Controls is aware that an attacker may be able to intercept and read sensitive information sent in cleartext, including credentials and session data. Successful exploitation could result in technical or operational impact.
EasyIO Neo controllers are programmable building automation edge devices used to manage HVAC, lighting and energy systems through a web-based interface. CISA lists deployment across critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy. The advisory describes the products as deployed worldwide.
Johnson Controls has released fixed firmware for the affected controller families. The fixed version for EC controllers is V3.3b64, while the fixed version for CW controllers is V3.3b26. HTTP communication is disabled by default in the latest version. Organizations using affected firmware should upgrade to the fixed version or later as soon as operationally feasible, while assessing the effect on production environments.
Before applying updates in industrial control or operational technology environments, users should review the potential operational impact, back up relevant configurations, test the updates in a non-production environment where feasible, and follow applicable change-management and safety procedures. The advisory directs users to contact a Johnson Controls representative or visit the company’s Trust Center for additional information.
If an immediate update is not possible, Johnson Controls recommends interim measures to reduce exposure. These include enabling and enforcing HTTPS or TLS for web-based management access, disabling HTTP access entirely, placing devices on an isolated and segmented network behind a firewall, and using a VPN for remote access. Network operators should also restrict management interfaces with access control lists that allow access only from trusted hosts and monitor network traffic for unencrypted sensitive data leaving the management interface.
The advisory says these mitigations reduce risk but may not fully remediate the vulnerability. It recommends that users update to the fixed versions when operationally feasible. Johnson Controls also directs users to its product hardening guide and universal hardening guide for additional security recommendations.
Defenders should review logs, network telemetry, device events and other security monitoring data associated with EasyIO Neo EC and CW controllers. CISA identifies unencrypted HTTP traffic involving the management interface on port 80, captured credentials or session tokens in HTTP requests, unexpected systems accessing the web console, address-resolution-protocol spoofing or other local man-in-the-middle indicators, and unauthorized configuration changes as relevant detection signals.
The advisory assigns the vulnerability a high attack complexity and says no known public exploitation specifically targeting it had been reported to CISA at the time of publication. Its CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N, reflecting network reachability, required privileges and user interaction alongside a high confidentiality impact. The advisory recommends that affected organizations assess operational risk, apply the fixed firmware when feasible, maintain appropriate network protections, and report suspected malicious activity through established procedures.