EasyIO FG (Product): news timeline & CVEs

Johnson Controls EasyIO FG

CISA says end-of-life Johnson Controls EasyIO FG firmware has hard-coded credential flaws and will not be patched.

CISA published an advisory for Johnson Controls EasyIO FG firmware 2.0b52 and earlier. CVE-2026-27872 and CVE-2026-27873 involve hard-coded credentials and improper privilege management that could give an attacker full device access; both are scored CVSS 7.7 and require local access with high complexity. The series is end-of-life and end-of-support, unsold since before 2019, and no firmware fix will be issued. Operators are told to migrate to EasyIO Neo and keep devices off the internet on segmented building-automation networks. Exploitation is not reported.

CISA Advisoriesupdated Oct 7, 15:39 UTC · 1d agofirst Oct 6, 12:00 UTC · 2d agoAdvisory 3 sources CVE-2026-27872 CVE-2026-278734· 1 read

[Control Systems] Johnson Controls security advisory (AV26-991)

Canada's Cyber Centre warns of vulnerabilities in Johnson Controls EasyIO controllers and urges updates.

On October 2, 2026, the Canadian Centre for Cyber Security issued advisory AV26-991 on Johnson Controls control-system products. As of October 1, 2026, affected versions include EasyIO FG before 2.0b52, EasyIO Neo before 3.3b63 and 3.3b25, and EasyIO FS32 before 3.0b63 and 3.3b63. The centre urges administrators to review Johnson Controls product security advisories and install updates as they become available. No CVE identifiers or observed exploitation are included.

Canadian Centre for Cyber Securityupdated Oct 7, 15:39 UTC · 1d agofirst Oct 2, 13:12 UTC · 6d agoAdvisory 3 sources1

EasyIO FG

Timeline2 articles

Related CVEsby mentions

Appears with

Johnson Controls EasyIO FG

[Control Systems] Johnson Controls security advisory (AV26-991)