Separate Johnson Controls EasyIO and Illustra advisories

CISA flags unpatched EasyIO FG credential flaws, while Canada separately warns on Illustra Standard without a CVE.

Two October 2026 notices cover different Johnson Controls products rather than the same flaw. CISA said EasyIO FG firmware 2.0b52 and earlier has CVE-2026-27872 and CVE-2026-27873, hard-coded credential and improper privilege-management issues scored CVSS 7.7 that could allow full device access; both need local access with high complexity, and exploitation is not reported. The EasyIO FG series is end-of-life and end-of-support, unsold since before 2019, and will not be patched; CISA says operators should migrate to EasyIO Neo and isolate devices from the internet on segmented building-automation networks. Separately, Canada's Cyber Centre published AV26-1010 on October 7, 2026, for Illustra Standard - L4L China versions before 6.0.0.66394, citing Johnson Controls information as of October 6. That notice gives no CVE, severity, or exploitation status and urges administrators to review vendor guidance and update when fixes are available. The sources do not contradict each other; they describe distinct products and remediation paths.