Johnson Controls Warns of High-Severity EasyIO FG Vulnerabilities
Tech GuruQuick Answer
Johnson Controls JCI-PSA-2026-12 covers EasyIO FG firmware 2.0b52 and earlier. Hard-coded credentials and improper privilege management can lead to unauthorized administrative access. The controller line is end-of-life and end-of-support: no FG firmware patch will be issued. Isolate affected controllers and plan a supported replacement with the building-operations team.
Contain Exposure And Plan Replacement
What to do now: confirm FG models and firmware, restrict network and physical/console access, preserve configuration and relevant logs, and plan replacement. There is no fixed FG build to install. EasyIO Neo R1 is a suggested migration platform, not firmware for an FG controller.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Johnson Controls EasyIO FG building-automation controllers |
|---|---|
| Advisory | JCI-PSA-2026-12 |
| CVEs | CVE-2026-27872, CVE-2026-27873 |
| Authoritative release date | 2026-10-01 (Johnson Controls date; no time stated) |
| Authority revision date | Initial publication; no later material revision stated when verified |
| Affected versions | EasyIO FG firmware 2.0b52 and earlier. |
| Fixed version | No fixed EasyIO FG firmware; migrate the end-of-life controller to a supported current-generation platform such as EasyIO Neo R1 |
| CVSS base score | 7.2 (official CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Johnson Controls does not report known public exploitation; no exploitation claim is inferred. |
What Changed
The vendor assigns CVSS v4.0 7.2 (High) with local access, high attack complexity, prerequisites and low privileges in the vector. Do not recast this as an unauthenticated Internet attack. Segmentation, trusted engineering access and physical protection reduce risk but do not remove the underlying weaknesses.
What To Validate Now
- Inventory. Record each FG controller, firmware, location, controlled equipment, engineering workstation, console access and accountable facilities owner. Separate FG assets from Neo products and other controllers.
- Establish applicability. Identify EasyIO FG controllers and confirm firmware 2.0b52 or earlier. Do not infer that EasyIO Neo products share this end-of-life disposition.
- Remediate. Plan migration to a supported current-generation controller, isolate affected devices and management interfaces, restrict remote access to approved paths, and follow current Johnson Controls hardening guidance until replacement is complete.
- Validate. Confirm segmentation and access controls, review controller and network telemetry, validate building-automation logic after migration, and document every temporary exception and retirement decision.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not abruptly power off or reconfigure a controller to demonstrate containment. Have qualified building-operations staff assess process impact, back up logic/configuration, plan a controlled replacement and validate the actual HVAC, lighting and energy sequences. Restrict unnecessary services and access paths only under approved safety and change procedures.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
