CVE-2026-64893 in EasyIO NEO
Summary
by MITRE • 10/02/2026
- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.
This issue affects EasyIO NEO: before 3.3b25.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability represents a critical failure in data confidentiality within the Johnson Controls EasyIO NEO building automation system, specifically affecting versions prior to 3.3b25. This flaw is classified as Cleartext Transmission of Sensitive Information, which corresponds directly to CWE-319 in the Common Weakness Enumeration standard. The core technical issue lies in the communication protocol used by the device for transmitting configuration data, status updates, or authentication credentials over the network without applying cryptographic encryption such as TLS or IPsec. Consequently, any data traversing the network interface is exposed in its original, readable format, making it trivially accessible to any entity with visibility into the network segment where the EasyIO NEO operates.
From an operational perspective, this lack of transport-layer security creates a significant attack surface for Man-in-the-Middle (MitM) attacks as defined by MITRE ATT&CK technique T1040. An adversary positioned on the same local area network can intercept these unencrypted packets using standard packet sniffing tools like Wireshark or tcpdump. By analyzing the captured traffic, an attacker can extract sensitive operational parameters, including device IP addresses, port configurations, and potentially hardcoded credentials used for administrative access. This interception does not require sophisticated exploitation techniques but rather basic network monitoring capabilities, lowering the barrier to entry significantly for potential attackers targeting industrial control systems or building management networks.
The impact of this vulnerability extends beyond simple data leakage. If authentication tokens or passwords are transmitted in cleartext during initial setup or periodic re-authentication processes, an attacker can capture these credentials and use them to gain unauthorized access to the device from a remote location on the network. Furthermore, because building automation systems often control critical infrastructure such as HVAC, lighting, and security doors, the ability to intercept configuration changes allows for potential manipulation of system behavior if combined with other vulnerabilities or if the protocol lacks integrity checks that would detect tampering during transit. This compromises both the confidentiality and potentially the integrity of the operational technology environment.
To mitigate this risk, immediate action is required to upgrade the EasyIO NEO firmware to version 3.3b25 or later, where Johnson Controls has addressed this deficiency by implementing encrypted communication channels. In environments where upgrading is not immediately feasible, network segmentation strategies should be employed to isolate the building automation systems from general corporate networks and untrusted zones. Implementing VLANs with strict access control lists can limit visibility of cleartext traffic to only authorized management stations. Additionally, deploying network monitoring solutions that detect unencrypted protocols on sensitive subnets can provide early warning indicators of compromise or unauthorized reconnaissance activities targeting these devices.