CVE-2026-34494 in Neo MVP2
Summary
by MITRE • 10/02/2026
- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.
This issue affects Neo Series MVP2: before 3.3b63.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Johnson Controls Neo Series MVP2 controller, specifically versions prior to 3.3b63, contains a critical security flaw within its on-chip debug interface that permits unauthorized data extraction from common resource locations. This vulnerability stems from the improper configuration or lack of adequate access controls surrounding hardware-level debugging ports such as JTAG (Joint Test Action Group) or SWD (Serial Wire Debug). In many embedded systems and industrial control devices, these interfaces are essential for manufacturing testing, firmware updates, and field diagnostics. However, when left enabled in production builds without strict authentication mechanisms, they provide a direct pathway to the device's internal memory architecture. An attacker with physical access to the controller can exploit this open channel to read sensitive configuration files, network credentials, encryption keys, or proprietary logic stored in flash memory and RAM.
From a technical perspective, this flaw represents a failure to implement secure boot processes and debug port locking mechanisms effectively during the firmware deployment phase. The Common Resource Locations likely include non-volatile storage areas where administrative passwords, Modbus TCP/IP settings, BACnet configurations, and potentially user data are persisted. By leveraging standard debugging tools connected to these exposed pins or connectors, an adversary can bypass all software-based security controls. This type of vulnerability is classified under CWE-284 Improper Access Control because it allows unauthorized entities to access resources that should be restricted. Furthermore, the ability to dump memory and extract secrets aligns with ATT&CK technique T1057 Output Armed Sensors Through Command and Control if used for reconnaissance or T1608 Install Defacement Tool if followed by modification, but primarily falls under data exfiltration techniques such as T1005 Data from Local System.
The operational impact of this vulnerability is severe within the context of Building Automation Systems (BAS) and Industrial IoT environments. Since these controllers often manage critical infrastructure like HVAC systems, access control doors, or fire suppression mechanisms, compromising their integrity can lead to significant physical security risks. An attacker could extract credentials to gain remote network access later, manipulate system parameters to cause environmental hazards, or disrupt operations by altering logic without leaving obvious software traces. The persistence of this flaw in firmware versions before 3.3b63 indicates a systemic issue where debug features were not disabled or secured during the final product release cycle, violating fundamental principles of secure development lifecycle for embedded devices.
To mitigate this risk, immediate action is required to update all affected Neo Series MVP2 controllers to version 3.3b63 or later, which presumably includes patches that disable unused debug interfaces or enforce strong authentication before allowing access. For systems where an upgrade is not immediately feasible, physical security controls must be strengthened to prevent unauthorized individuals from accessing the controller hardware and its external test points. Additionally, network segmentation should be implemented to isolate these controllers from general corporate networks, reducing the attack surface if any secondary vulnerabilities exist that could allow remote exploitation of debug features over a connected bus or Ethernet port. Regular audits of firmware versions and physical inspection of installed devices for exposed debugging headers are recommended best practices to maintain the security posture of industrial control systems.