Johnson Controls Releases EasyIO Neo Firmware and Hardware Fixes
Tech GuruQuick Answer
EasyIO Neo EC V3.3b62/b63 and CW V3.3b24/b25 require attention to both firmware and hardware. EC V3.3b64 and CW V3.3b26 address the firmware findings. For the SWD debug-interface findings in JCI-PSA-2026-19, Johnson Controls considers replacement with the revised hardware remediated; installing the same firmware number on old hardware does not remove physical pins.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Johnson Controls EasyIO Neo Series EC and CW controllers, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Johnson Controls EasyIO Neo Series EC and CW controllers |
|---|---|
| Advisory | JCI-PSA-2026-19 / JCI-PSA-2026-20 / JCI-PSA-2026-30 / ICSA-26-274-04 / ICSA-26-274-05 |
| CVEs | CVE-2026-34493, CVE-2026-34494, CVE-2026-64892, CVE-2026-64893 |
| Authoritative release date | 2026-10-01 (authority date; no vendor time stated; CISA publication 06:00 UTC) |
| Authority revision date | Initial publication; no later material revision stated when verified |
| Affected versions | EasyIO Neo EC V3.3b62 and V3.3b63, and EasyIO Neo CW V3.3b24 and V3.3b25. |
| Fixed version | EC firmware V3.3b64 / CW firmware V3.3b26, plus revised hardware with SWD debug pins removed for the physical-debug findings |
| CVSS base score | CISA v3.1: 3.5 for CVE-2026-64892 and 5.4 for CVE-2026-64893. JCI v4.0: 5.9 for CVE-2026-34493/34494 and 5.5 for CVE-2026-64893. JCI-PSA-2026-20 labels CVE-2026-64892 High but supplies no numeric score and an incomplete vector. |
| CVSS severity | CISA Low/Medium; JCI Medium for PSA 19/30 and High for PSA 20. Do not combine different scoring systems into one unqualified range. |
| Exploitation status | Johnson Controls and CISA do not report known public exploitation; no exploitation claim is inferred. |
What Changed
PSA 19 covers physical debug-interface tampering, PSA 20 sensitive-information exposure, and PSA 30 cleartext credentials/session data. PSA 30 disables HTTP by default in the fixed firmware. The vendor PSA 19 physical-access description also differs from its published network attack-vector field; the practical hardware replacement requirement remains explicit.
What To Validate Now
- Inventory. Locate Johnson Controls EasyIO Neo Series EC and CW controllers deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match controller family, hardware revision, and exact EC or CW firmware. Do not treat firmware alone as resolving a finding that requires revised hardware.
- Remediate. Deploy EC V3.3b64 or CW V3.3b26 through the supported channel, confirm revised hardware for the SWD findings, disable HTTP, enforce HTTPS/TLS, restrict physical and management access, and follow Johnson Controls hardening guidance.
- Validate. Record controller family, actual hardware revision and firmware separately. Have facilities staff verify controller logic and normal HVAC/lighting sequences. Check management access uses HTTPS and that HTTP is disabled as intended; do not assume a default is effective on a migrated configuration. Protect packet captures because they may contain credentials.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Back up logic/configuration and schedule firmware or hardware work with facilities and safety owners. Obtain vendor confirmation of the replacement hardware; do not probe, remove pins or modify a live controller to test applicability. Source severity differences and the incomplete PSA 20 vector remain unresolved, not independent lab findings.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
