Johnson Controls EasyIO Neo Controllers Expose Data in Cleartext

Key points

• CVE-2026-64893 impacts Johnson Controls EasyIO Neo Series EC and CW controllers.
• Attackers could intercept sensitive information, including credentials and session data, because traffic is cleartext.
• Affected deployments span worldwide sectors such as energy, transportation, government services, commercial facilities, and critical manufacturing.
• Severity is rated medium; prioritize patching, segmentation, and encrypted management access.

Johnson Controls has disclosed a medium-severity vulnerability affecting its EasyIO Neo Series EC Controllers and EasyIO Neo Series CW Controllers. Tracked as CVE-2026-64893, the issue involves cleartext transmission, meaning data moving across the network is not protected by encryption. An attacker with a suitable network position could intercept sensitive information, read credentials, and capture session data.

The exposure is not limited to a single region or industry. Entities around the world might be impacted, notably those in essential manufacturing, commercial establishments, public services, transport networks, and energy. These environments often rely on controllers for operational functions, so unauthorized access or credential theft can create follow-on risks beyond the initial data exposure.

For K-12 and government IT teams, the medium rating should not lead to complacency. Cleartext traffic can be captured and reused, and stolen session data may allow an adversary to impersonate legitimate users or devices. If affected controllers are reachable from broader networks, the vulnerability could become a stepping stone for lateral movement or disruption.

What to watch: Johnson Controls guidance and any firmware or software updates that address CVE-2026-64893. Until fixes are applied, network segmentation, encrypted management paths, credential rotation, and close monitoring of controller access are the most practical defenses. Administrators should also verify whether these controllers are exposed to untrusted networks or the internet.

What to do now

1. Inventory all EasyIO Neo Series EC and CW controllers, including firmware versions, network locations, and internet exposure.
2. Apply Johnson Controls firmware or software updates that address CVE-2026-64893 as soon as they are available.
3. Place affected controllers on isolated OT or building-management VLANs and block unnecessary access from user, guest, and internet-facing networks.
4. Replace cleartext management protocols with encrypted alternatives such as HTTPS, SSH, or VPN access where the devices support them.
5. Rotate credentials and session tokens associated with affected controllers, then monitor for signs of reuse or anomalous authentication.
6. Restrict management interfaces to trusted administrator hosts and enable logging or alerting for unexpected access attempts.
7. If patching is delayed, disable remote management or apply temporary compensating controls until the vendor fix can be deployed.

CVE references

• CVE-2026-64893

Original source

CISA Advisories