Johnson Controls EasyIO Neo controllers transmit credentials in cleartext over HTTP, enabling network attackers to intercept session data via CVE-2026-64893. CVE-2026-64893 enables man-in-the-middle interception of credentials and session tokens transmitted in cleartext over HTTP to EasyIO Neo EC and CW building automation controllers. Attack requires network positioning and user interaction. Fixed in EC firmware V3.3b64 and CW firmware V3.3b26. Affected deployments span critical manufacturing, energy, transportation, and government facilities worldwide.
CVE-2026-64893
1 post
Johnson Controls EasyIO Neo Series EC and CW Controllers (CVE-2026-64893)