OTPulse

Johnson Controls EasyIO FG

MonitorCVSS 7.7ICS-CERT ICSA-26-279-01Oct 6, 2026
Johnson Controls
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Johnson Controls EasyIO FG Series (firmware ≤2.0b52) contains vulnerabilities related to hardcoded credentials and improper access control that could allow an attacker to gain full administrative access to the device. The product has reached End-of-Life (EOL) and End-of-Support (EOS) status; no firmware patch will be issued. The vendor recommends migration to the EasyIO Neo R1 Series or other current-generation products. In the interim, the device must be isolated within dedicated BAS/OT networks with strict VLAN segmentation, no Internet exposure, and access restricted to trusted engineering workstations.

What this means
What could happen
An attacker with local or network access to the device could gain full administrative control over the EasyIO FG controller, allowing them to alter building automation setpoints, disable alarms, or disrupt HVAC and other mechanical systems.
Who's at risk
Building Automation System (BAS) operators and facilities managers responsible for HVAC, lighting, and other mechanical systems that rely on Johnson Controls EasyIO FG Series controllers should prioritize migration, as the product is end-of-life and will not receive security patches.
How it could be exploited
An attacker with credentials or local access to an EasyIO FG device could exploit hardcoded or weak authentication mechanisms to assume full administrative privileges. Once authenticated, the attacker could execute arbitrary commands on the controller and manipulate the building automation system.
Prerequisites
  • Local or network access to the EasyIO FG device
  • Valid user-level credentials or ability to bypass authentication
  • Physical access to engineering interfaces (potential alternative)
no patch availableend-of-life producthardcoded or weak credentials (CWE-798)privilege escalation risk (CWE-269)
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (1)
ProductAffected VersionsFix Status
EasyIO FG firmware≤ 2.0b52No fix yet
Remediation & Mitigation
0/5
Do now
0/4
HARDENINGIsolate EasyIO FG devices within dedicated Building Automation System (BAS) or OT networks, segregated from all IP-connected systems
HARDENINGEnforce VLAN segmentation to prevent direct communication between EasyIO FG devices and enterprise IT networks
HARDENINGBlock all Internet-facing routes to EasyIO FG devices; ensure no external connectivity or port forwarding
HARDENINGRestrict network access to EasyIO FG devices to trusted engineering workstations only; deploy firewall rules or access control lists
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXMigrate from EasyIO FG to a supported current-generation product such as EasyIO Neo R1 Series
View full CISA ICS-CERT advisory
API: /api/v1/advisories/187aceb0-6cb9-4266-94ff-d08c66c92e98

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Johnson Controls EasyIO FG | CVSS 7.7 - OTPulse