OTPulse

Johnson Controls EasyIO Neo Series EC and CW Controllers

MonitorCVSS 5.4ICS-CERT ICSA-26-274-05Oct 1, 2026
Johnson Controls
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary

EasyIO Neo Series EC and CW Controllers versions V3.3b62/b63 (EC) and V3.3b24/b25 (CW) transmit management credentials and session data over unencrypted HTTP by default. An attacker on the network can intercept these transmissions to extract plaintext credentials and session tokens, then use them to gain unauthorized access to the controller's management interface and modify operational parameters. Johnson Controls has released fixed versions (EC V3.3b64, CW V3.3b26) that disable HTTP by default and enforce HTTPS/TLS.

What this means
What could happen
An attacker could intercept unencrypted management traffic to read credentials and session tokens, potentially gaining access to modify controller settings that affect building automation or HVAC operations.
Who's at risk
Building automation and HVAC system operators using Johnson Controls EasyIO Neo Series EC or CW Controllers (versions V3.3b62, V3.3b63, V3.3b24, or V3.3b25) should assess their exposure. This affects any facility where these controllers manage climate control, equipment sequencing, or other automated processes accessed via web-based management interfaces.
How it could be exploited
An attacker on the network intercepts HTTP traffic to the controller's management interface (port 80). Because HTTP is unencrypted and enabled by default in affected versions, the attacker can extract plaintext credentials or valid session tokens from network packets. With these credentials, the attacker can then access the web management console to alter process parameters, disable safety interlocks, or disrupt operations.
Prerequisites
  • Network access to port 80 (HTTP management interface)
  • Ability to perform packet capture or man-in-the-middle attack on the same network segment
  • User must actively log in to the web interface (credentials are transmitted during login)
remotely exploitableno authentication required for network access to port 80HTTP enabled by defaultcredentials transmitted in cleartextaffects building automation systems
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (4)
4 pending
ProductAffected VersionsFix Status
EasyIO Neo Series EC Controllers: V3.3b62V3.3b62No fix yet
EasyIO Neo Series EC Controllers: V3.3b63V3.3b63No fix yet
EasyIO Neo Series CW Controllers: V3.3b24V3.3b24No fix yet
EasyIO Neo Series CW Controllers: V3.3b25V3.3b25No fix yet
Remediation & Mitigation
0/7
Do now
0/4
WORKAROUNDEnable and enforce HTTPS/TLS for all web-based management access to affected devices
WORKAROUNDDisable HTTP access on affected devices entirely if HTTPS is available
HARDENINGRestrict network access to the controller management interface (port 80/443) using firewall ACLs to only trusted administrative hosts
HARDENINGUse a VPN when accessing controller management interfaces remotely to encrypt all traffic in transit
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate EasyIO Neo Series EC Controllers to firmware V3.3b64 or later
HOTFIXUpdate EasyIO Neo Series CW Controllers to firmware V3.3b26 or later
Long-term hardening
0/1
HARDENINGIsolate EasyIO controllers on a segmented management network separate from general IT networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/7962f2bd-e1e8-4881-b559-258f91ad7492

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Johnson Controls EasyIO Neo Series EC and CW Controllers | CVSS 5.4 - OTPulse