CISA 2026-10-06

Johnson Controls EasyIO FG

Machine-generated analysis · WAYSCloud LLM

EasyIO FG firmware up to version 2.0b52 contains hard-coded credentials and lacks a patch because the product is end-of-life. No firmware update will be released.

Context

Johnson Controls EasyIO FG firmware versions up to 2.0b52 are identified as affected. The advisory states that hard-coded credentials and improper privilege management could allow an attacker full unauthorized access to the device. Johnson Controls has declared the series end-of-life and will not provide a code fix, recommending migration to the EasyIO Neo R1 series.

Operator considerations

Check: Verify firmware versions of all EasyIO FG devices and identify any running <=2.0b52.
Isolate: Deploy affected devices in isolated BAS/OT networks and enforce VLAN segmentation from enterprise IT.
Patch: No patch is available; migrate to a supported Johnson Controls product such as the EasyIO Neo R1 series.
Log: Monitor for unauthorized login attempts or use of default credentials on these devices.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device.

The following versions of Johnson Controls EasyIO FG are affected:

EasyIO FG firmware

Read the full advisory on CISA →