Johnson Controls Releases EasyIO Neo Firmware and Hardware Fixes
Tech GuruQuick Answer
The authority published JCI-PSA-2026-19 for Johnson Controls EasyIO Neo Series EC and CW controllers. Johnson Controls and CISA document exposed physical debug access, missing debug authentication, and cleartext transmission risks. The authorities provide corrected firmware and, for the physical-debug findings, revised hardware. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Johnson Controls EasyIO Neo Series EC and CW controllers, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Johnson Controls EasyIO Neo Series EC and CW controllers |
|---|---|
| Advisory | JCI-PSA-2026-19 / JCI-PSA-2026-20 / JCI-PSA-2026-30 / ICSA-26-274-04 / ICSA-26-274-05 |
| CVEs | CVE-2026-34493, CVE-2026-34494, CVE-2026-64892, CVE-2026-64893 |
| Authoritative release date | 2026-10-01 (authority date; no vendor time stated; CISA publication 06:00 UTC) |
| Authority revision date | Initial publication; no later material revision stated when verified |
| Affected versions | EasyIO Neo EC V3.3b62 and V3.3b63, and EasyIO Neo CW V3.3b24 and V3.3b25. |
| Fixed version | EC firmware V3.3b64 / CW firmware V3.3b26, plus revised hardware with SWD debug pins removed for the physical-debug findings |
| CVSS base score | 3.5 / 5.4 / 5.9 (official CISA CVSS v3.1 and Johnson Controls CVSS v4 scores) |
| CVSS severity | Low to Medium |
| Exploitation status | Johnson Controls and CISA do not report known public exploitation; no exploitation claim is inferred. |
What Changed
Johnson Controls and CISA document exposed physical debug access, missing debug authentication, and cleartext transmission risks. The authorities provide corrected firmware and, for the physical-debug findings, revised hardware.
What To Validate Now
- Inventory. Locate Johnson Controls EasyIO Neo Series EC and CW controllers deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match controller family, hardware revision, and exact EC or CW firmware. Do not treat firmware alone as resolving a finding that requires revised hardware.
- Remediate. Deploy EC V3.3b64 or CW V3.3b26 through the supported channel, confirm revised hardware for the SWD findings, disable HTTP, enforce HTTPS/TLS, restrict physical and management access, and follow Johnson Controls hardening guidance.
- Validate. Confirm firmware and hardware revision, validate controller logic and building-automation workflows, inspect HTTP, ARP, management, device, and configuration telemetry, and retain before-and-after evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Back up configuration and controller logic, test in a non-production environment where feasible, coordinate with facilities and safety owners, and retain evidence before replacing hardware or resetting devices.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
