Johnson Controls EasyIO Neo Series EC and CW controllers contain a vulnerability that can expose credentials and session data transmitted across a network in cleartext, the Cybersecurity and Infrastructure Security Agency said in an advisory published October 1. The issue, tracked as CVE-2026-64893, affects specific firmware versions used in building automation systems.
The affected EC firmware versions are V3.3b62 and V3.3b63. The affected CW versions are V3.3b24 and V3.3b25. CISA lists the flaw as CWE-319, Cleartext Transmission of Sensitive Information, with a CVSS 3.1 base score of 5.4, rated medium.
EasyIO Neo is a programmable building automation edge controller that manages HVAC, lighting and energy systems through a web-based interface. The vulnerability can allow an attacker to intercept and read sensitive information sent over the network, including login credentials and session data. CISA said successful exploitation could produce technical or operational impact.
Johnson Controls has released corrected firmware for both controller families. The fix is available in EC firmware V3.3b64 and CW firmware V3.3b26, with HTTP communication disabled by default in the latest versions. Users should upgrade to the fixed version or later as soon as operationally feasible, CISA said, while contacting a Johnson Controls representative or consulting the company’s Trust Center for additional information.
The advisory’s scoring indicates that exploitation requires network access, high attack complexity, low-level privileges and user interaction. CISA also reported that no known public exploitation specifically targeting this vulnerability had been reported to the agency at the time of publication.
Organizations unable to update immediately should enforce HTTPS or TLS for web-based management access and disable HTTP entirely. CISA and Johnson Controls also recommend placing the controllers on isolated, segmented networks behind firewalls, using a VPN for remote access, and limiting management interfaces through access-control lists to trusted hosts. Those measures reduce exposure but do not fully remediate the flaw.
Before deploying firmware in production industrial-control or operational-technology environments, administrators should assess operational impact, back up relevant configurations, test the update in a non-production setting where feasible, and follow applicable change-management and safety procedures. The advisory also directs defenders to watch for unencrypted HTTP traffic on port 80, network captures containing cleartext credentials or session tokens, unexpected access to the web console, signs of ARP spoofing or other man-in-the-middle activity, and unauthorized configuration changes.
The affected controllers are used in sectors that include commercial facilities, critical manufacturing, government services and facilities, transportation systems and energy. CISA identifies the products as deployed worldwide and recommends applying Johnson Controls’ hardening guidance alongside the firmware update. Additional mitigation instructions are available in Johnson Controls Product Security Advisory JCI-PSA-2026-30, which CISA links from its notice.