CISA has warned that two vulnerabilities in Johnson Controls EasyIO FG firmware could allow an attacker to gain full unauthorized access to an affected device. The advisory, published October 6, assigns the flaws a CVSS v3.1 base score of 7.7, rated high, and identifies the affected product as EasyIO FG firmware. CISA’s ICS advisory lists the product as known affected.

The affected EasyIO FG devices are used in critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy. CISA lists deployments worldwide. The advisory identifies the EasyIO FG Series as the affected product line and says the vulnerabilities could result in full device compromise, as well as technical or operational impact.

The flaws are tracked as CVE-2026-27872 and CVE-2026-27873. CISA describes both as involving hard-coded credentials and improper privilege management. The agency says successful exploitation could allow an attacker to gain unauthorized access to the system. Both vulnerabilities carry the same CVSS v3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H.

Under the advisory’s stated conditions, the vulnerabilities require local access and have high attack complexity. They are not remotely exploitable, and CISA says no known public exploitation specifically targeting these vulnerabilities has been reported. The scoring information also lists a requirement for low privileges and no user interaction. The advisory does not identify a firmware update for either flaw.

Johnson Controls will not issue a firmware patch or code-level fix. CISA reports that the EasyIO FG Series reached end-of-life and end-of-support status, was no longer manufactured or sold before 2019, and has source code that is no longer available. The recommended long-term action is migration to a supported current-generation product, such as the EasyIO Neo R1 Series.

Until migration is possible, CISA and Johnson Controls recommend placing EasyIO FG devices only inside isolated building automation or operational technology networks. Organizations should prevent direct Internet exposure, enforce strict VLAN separation from enterprise IT networks, and limit access to trusted engineering workstations. Remote login from untrusted networks should be blocked. Connections should be restricted to approved IP addresses and only the protocols required for operation.

The advisory also calls for blocking Internet-originated traffic and taking steps to prevent unauthorized lateral movement across networks. Operators should disable insecure services, including Telnet when enabled, and remove unnecessary services or exposed ports. CISA and Johnson Controls also recommend restricting physical and console access and protecting firmware images from unauthorized distribution.

Monitoring is part of the recommended mitigation. CISA says organizations should watch for repeated login attempts and unauthorized or root-level access. Where supported, operators should enable logging and centralized monitoring. These measures are intended to help organizations identify attempts to access or alter affected devices.

CISA recommends that organizations place control-system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, the agency recommends more secure methods such as virtual private networks, while noting that VPNs and the devices connected through them should be kept current. Organizations should perform an impact analysis and risk assessment before applying defensive measures.

The agency advises organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation. For the affected EasyIO FG Series, migration remains the recommended long-term response because the product is no longer supported and no firmware or code-level repair will be issued.