CVE-2026-64893 is a cleartext-transmission flaw (CWE-319) in Johnson Controls' EasyIO Neo series EC and CW building-automation controllers: credentials and session data travel unencrypted over the network, so an attacker able to intercept that traffic can read them and potentially impersonate a legitimate user; NVD has not, as of 2026-11-07, published its own CVSS score.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
0.1%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-64893 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Johnson Controls EasyIO Neo series EC and CW building-automation controllers | — | EC Controllers before V3.3b64 (confirmed vulnerable: V3.3b62, V3.3b63); CW Controllers before V3.3b26 (confirmed vulnerable: V3.3b24, V3.3b25) |
What does this mean for affected devices?
CVE-2026-64893 (CWE-319, cleartext transmission of sensitive information) affects Johnson Controls' EasyIO Neo series building-automation controllers. NVD's description states: "Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25" (NVD), and CISA's advisory elaborates that the flaw "may allow an attacker to intercept and read sensitive information, including credentials and session data, transmitted in cleartext over the network" (CISA ICS Advisory ICSA-26-274-05).
EasyIO Neo EC and CW controllers are physical programmable building-automation edge controllers that support protocols such as BACnet and Modbus to manage HVAC, lighting and other building systems; CISA's advisory lists the affected sectors as Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy, with worldwide deployment (CISA ICS Advisory ICSA-26-274-05).
NVD tracks CVE-2026-64893 with status "Deferred" as of 2026-10-02: it records only a Johnson Controls PSIRT-submitted score (source [email protected]) — CVSS v4.0 7.3 (high), vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed. CISA's advisory separately lists a CVSS v3.1 score of 5.4, vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N (NVD, CISA ICS Advisory ICSA-26-274-05).
Researcher Gabriele Gardois reported the issue to Johnson Controls, which published a companion advisory the same day for CVE-2026-64892, a lower-severity information-exposure flaw on the same controller line requiring physical access to a debug port (CISA ICS Advisory ICSA-26-274-05).
Johnson Controls' remediation is to upgrade EC controllers to firmware V3.3b64 and CW controllers to firmware V3.3b26, which disable HTTP communication by default; where an immediate update is not possible, the vendor recommends enforcing HTTPS/TLS, disabling HTTP, network segmentation, VPN for remote access and access-control lists (CISA ICS Advisory ICSA-26-274-05).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00119 (1.783rd percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis. In the meantime, EasyIO Neo operators should update EC controllers to V3.3b64 and CW controllers to V3.3b26, enforce HTTPS/TLS, and segment building-automation networks from untrusted traffic.
Evidence
- EasyIO NEO controllers transmit credentials and session data in cleartext over the network, allowing a man-in-the-middle attacker to intercept and read them (CWE-319); affects versions before 3.3b25 (and the sibling EC line before 3.3b64). — NVD
- EasyIO Neo EC/CW controllers are physical BACnet/Modbus building-automation edge controllers; advisory affects Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy sectors worldwide. — CISA ICS Advisory ICSA-26-274-05
- NVD status is "Deferred" with a Johnson Controls PSIRT-submitted Secondary CVSS v4.0 7.3; no NVD-published Primary score as of 2026-10-02. CISA's advisory separately lists a CVSS v3.1 score of 5.4. — NVD
- Reported by Gabriele Gardois; companion CVE-2026-64892 (debug-port information exposure) disclosed the same day; fix is EC firmware V3.3b64 / CW firmware V3.3b26, which disable HTTP by default. — CISA ICS Advisory ICSA-26-274-05
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00119 (1.783rd percentile) as of 2026-11-06. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2026-64893?
CVE-2026-64893 is a cleartext-transmission flaw (CWE-319) in Johnson Controls' EasyIO Neo series EC and CW building-automation controllers: credentials and session data travel unencrypted over the network, so an attacker able to intercept that traffic can read them and potentially impersonate a legitimate user; NVD has not, as of 2026-11-07, published its own CVSS score.
How severe is CVE-2026-64893?
CVE-2026-64893 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2026-64893 being actively exploited?
CVE-2026-64893 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.12%.
What is affected by CVE-2026-64893?
CVE-2026-64893 affects Johnson Controls EasyIO Neo series EC and CW building-automation controllers.
Where does this CVE-2026-64893 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-26-274-05, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?