CVE-2026-27873: Johnson Controls EasyIO FG Hard-Coded Creds (pending)

Checked: 2026-10-27

Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-27873 is a hard-coded-credentials flaw in Johnson Controls' EasyIO FG building-automation controller that enables password-spraying attacks against the device; no firmware patch exists because the product is past end-of-life, so NVD has not yet completed its own CVSS scoring, and this page stays noindex until that analysis is published.

Vulnerability summary

Vulnerability ID	CVE-2026-27873
CVSS score	Not yet scored by NVD
EPSS score	0.00087
CISA KEV	No
Source	NVD
Published	2026-10-01T22:17:01.450

Affected components

Component	CPE	Version range
Johnson Controls EasyIO FG	—	firmware before 2.0b52 (no fix available — product reached End-of-Life/End-of-Support before 2019, per CISA ICS Advisory ICSA-26-279-01; migration to the current EasyIO Neo R1 Series is the vendor's recommended path)

What this means

CVE-2026-27873 is a use of hard-coded credentials vulnerability (CWE-798) in Johnson Controls' EasyIO FG, a building-automation system controller. NVD's description states the issue "allows Password Spraying" and affects EasyIO FG firmware before version 2.0b52 (NVD).

NVD tracks the CVE with status "Deferred" as of 2026-10-27: it records only a CNA-submitted CVSS v4.0 score of 5.6 (medium), vector CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:P, with no CVSS v3.1 score and no NVD-published independent score or CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).

CISA's advisory ICSA-26-279-01, published 2026-10-06, confirms EasyIO FG firmware 2.0b52 and earlier is affected and discloses a related flaw in the same advisory, CVE-2026-27872 (improper privilege management enabling brute-force attacks, CVSS v3.1 7.7 high / v4.0 7.2 high, together capable of "full device compromise"). Critically, CISA states no firmware patch is available because the product reached End-of-Life/End-of-Support status prior to 2019; recommended defenses instead are network isolation and VLAN segmentation, whitelisted IP access controls, disabling insecure services such as Telnet, centralized monitoring and logging, and migrating to the current EasyIO Neo R1 Series. CISA also notes these vulnerabilities require local access and have not been publicly exploited (CISA ICS Advisory ICSA-26-279-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00087 (0.3th percentile) as of 2026-10-26 — very low, consistent with a flaw that needs local network access against long-unsupported hardware rather than being remotely exploitable (CISA KEV, FIRST EPSS).

Because no firmware fix will ever ship for this end-of-life controller, this page does not yet meet the minimum data bar for indexing and will be revisited once NVD completes its analysis. In the meantime, operators still running EasyIO FG should isolate it on a segmented VLAN with IP allow-listing, disable Telnet and other insecure services, and plan a migration to the EasyIO Neo R1 Series rather than waiting on a patch that will not come.

How to fix this class of issueThis advisory's weakness class is Hard-coded credentials. Our practical guide covers how to detect, fix, verify and disclose it: How to fix hard-coded credentials in embedded firmware.

Evidence

Use of hard-coded credentials in EasyIO FG firmware before 2.0b52 allows password spraying (CWE-798). — NVD
NVD status is "Deferred" with a CNA-submitted CVSS v4.0 5.6 only (no v3.1 score), no NVD-published score or CPE configuration as of 2026-10-27. — NVD
Affects EasyIO FG firmware through 2.0b52; no firmware patch exists (product reached End-of-Life/End-of-Support before 2019); disclosed alongside related CVE-2026-27872 (brute force via improper privilege management, 7.7/7.2); recommends network isolation, whitelisting, disabling Telnet, and migration to EasyIO Neo R1; requires local access, not publicly exploited. — CISA ICS Advisory ICSA-26-279-01
Not present in the CISA KEV catalog as of 2026-10-27. — CISA KEV
EPSS score is 0.00087 (0.3th percentile) as of 2026-10-26. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)CVE-2025-62593: KEV code injection in Ray lets an attacker combine DNS rebinding with a Firefox/Safari User-Agent spoof to reach a developer's local Ray dashboard and run arbitrary code. Sourced to NVD, CISA and Ray-Project.