Hard-coded Credentials and Privilege Management Vulnerabilities in Johnson Controls EasyIO FG

Johnson Controls EasyIO FG series devices running firmware version 2.0b52 or earlier are susceptible to vulnerabilities identified as CVE-2026-27872 and CVE-2026-27873. These vulnerabilities stem from the use of hard-coded credentials (CWE-798) and improper privilege management (CWE-269), which can be leveraged by an attacker to gain unauthorized access and potentially achieve full device compromise. These devices are used globally in critical infrastructure sectors, including energy, manufacturing, and transportation. Because the EasyIO FG series has reached End-of-Life (EOL) and End-of-Support (EOS) status, Johnson Controls will not issue any firmware patches or code-level fixes. Organizations currently utilizing these devices in their OT/BAS networks must rely on strict network segmentation and compensatory controls to mitigate the risk of unauthorized access.

Impact

Successful exploitation of these vulnerabilities allows an attacker to bypass authentication mechanisms and elevate privileges, leading to full control over affected EasyIO FG hardware. Given the role of these devices in critical infrastructure such as energy and manufacturing, a compromise could result in operational disruptions, unauthorized manipulation of physical processes, or lateral movement into broader OT environments. Since no patches are available, the risk remains persistent for any device left connected to a network.

Recommendation

Prioritized actions for security teams:

• Migrate all instances of the EasyIO FG series to current, supported hardware, such as the EasyIO Neo R1 Series, as the affected devices are EOL.
• Implement strict network isolation for any remaining units by placing them in isolated BAS/OT VLANs with no direct Internet connectivity.
• Configure firewalls to allow connections only from whitelisted engineering workstation IP addresses and block all remote login access from untrusted segments.
• Disable all unnecessary services on the devices, specifically Telnet or other insecure legacy management protocols.
• Monitor logs for repeated failed login attempts or unauthorized attempts to gain root-level access to the management interface.
• Refer to the manufacturer's advisory JCI-PSA-2026-12 for detailed mitigation and hardening steps.