Your building automation system might be leaking data
On October 1, 2026, CISA published advisory ICSA-26-274-04 covering a vulnerability in Johnson Controls EasyIO Neo Series EC and CW Controllers. The short version: an attacker who can reach one of these devices over the network could pull sensitive information from it, then use that information to push further into your systems.
If your building runs HVAC, lighting, or energy management through EasyIO Neo controllers, this is worth fifteen minutes of your time today. These aren’t obscure industrial machines. They’re the kind of programmable edge controllers that sit inside commercial facilities, office buildings, and mixed-use properties managing everyday building functions.
What exactly is vulnerable
The affected firmware versions are EC Controllers V3.3b63 and V3.3b62, and CW Controllers V3.3b25 and V3.3b24. All four are tracked under CVE-2026-64892, which is classified as exposure of sensitive information to an unauthorized actor.
The CVSS 3.1 base score is 3.5, which sounds low. But the CVSS 4.0 score comes in at 4.8 medium, and the scoring context matters here. The attack vector is network-accessible, meaning someone doesn’t need to be physically standing next to the controller. The attack complexity is low. The main limiting factor is that the attacker needs high privileges first, which is why the score stays moderate. That’s not a reason to ignore it. Privilege escalation in building systems happens, especially when default credentials haven’t been changed or debug ports are left open.
These controllers support BACnet and Modbus, open protocols that are common in building automation. That openness is useful for integration but also means more potential entry points if the network isn’t properly segmented.
The fix is available now
Johnson Controls released patched firmware. EC controllers should be updated to V3.3b64 and CW controllers to V3.3b26. Contact your Johnson Controls representative or authorized EasyIO distributor to get the update. Before you push anything to production, back up your configurations and test in a non-production environment if you have one. That’s standard change management, and it matters more in OT environments where a bad update can take a system offline.
If you can’t update immediately, Johnson Controls recommends a set of interim steps worth taking seriously:
- Lock down physical access to device debug ports.
- Apply least-privilege principles to all accounts touching these devices.
- Monitor network traffic to and from the controllers for anything unusual.
- Put intrusion detection in front of these systems if you haven’t already.
These steps reduce risk but don’t fully close the vulnerability. The firmware update is the real fix.
Why building systems keep showing up in security advisories
This isn’t the first time building automation and edge controllers have landed in a CISA advisory, and it won’t be the last. The pattern is consistent across OT and IoT hardware. Devices get deployed, connected to networks for remote management, and then forgotten from a security standpoint. Nobody’s running a patch cycle on the HVAC controller the way they would on a Windows server.
If you manage a facility with any kind of industrial control or building automation hardware, it’s worth having a documented inventory of what firmware versions are running. That single step makes responding to advisories like this one much faster. For context on how similar vulnerabilities play out across connected hardware, the AutomationDirect Productivity Suite advisory covering six separate flaws is a useful comparison, and the Weintek HMI security flaw write-up covers another common building-adjacent device category.
Check your firmware versions, get the update scheduled, and make sure whoever manages your building systems is looped in. If you want help building a process for tracking and patching OT and IoT devices alongside your regular IT infrastructure, booking an IT assessment with Exine is a reasonable starting point.
FAQ
Which Johnson Controls EasyIO firmware versions are affected by CVE-2026-64892?
EC Controllers V3.3b63 and V3.3b62, and CW Controllers V3.3b25 and V3.3b24 are all affected. The patched versions are EC firmware V3.3b64 and CW firmware V3.3b26, released by Johnson Controls as of October 1, 2026.
How serious is this EasyIO Neo vulnerability?
The CVSS 4.0 score is 4.8, rated medium. An attacker needs high privileges to exploit it, but the attack works over the network and doesn’t require physical access. It exposes sensitive information that could enable follow-on attacks against the same system.
Can someone exploit this vulnerability without being on-site?
Yes. The attack vector is network-based, meaning remote exploitation is possible if the controller is reachable over a network. Proper network segmentation and limiting remote access to these devices reduces that exposure significantly while you wait for a maintenance window to apply the firmware update.
What should I do if I can’t patch the EasyIO controller right away?
Johnson Controls recommends restricting physical access to debug ports, applying least-privilege account controls, monitoring network traffic for unusual activity, and using intrusion detection where possible. These steps lower risk but don’t replace the firmware update to V3.3b64 or V3.3b26.
