As cited
Copy frozen at (site build).
vulnerabilities
Johnson Controls EasyIO FG
Johnson Controls EasyIO FG firmware version 2.0b52 and earlier contains two vulnerabilities (CVE-2026-27872, CVE-2026-27873) involving hard-coded credentials and improper privilege management that could allow local attackers to gain full device compromise with a CVSS score of 7.7. The product reached end-of-life and end-of-support status prior to 2019, so no firmware patches will be issued. Johnson Controls recommends migration to current-generation products such as EasyIO Neo R1 Series and implementation of network segmentation, access controls, and monitoring.
Why it matters: Organizations operating legacy Johnson Controls building automation systems with EasyIO FG devices must prioritize migration or isolate affected equipment behind firewalls and VLAN segmentation to prevent local attackers from compromising critical infrastructure in manufacturing, energy, transportation, and government facilities.
- Source published
- First seen by Cybersecurity Tracker