[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-two-flaws-found-in-johnson-controls-building-controllers":10,"sections":37},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":36,"feedback_at":22,"cost_usd":36,"total_tokens":36},9390,"two-flaws-found-in-johnson-controls-building-controllers","Two Flaws Found in Johnson Controls Building Controllers","CISA disclosed two bugs in Johnson Controls EasyIO Neo building controllers, one leaking data and one exposing credentials in plaintext, both now patched.","Johnson Controls has patched two security flaws in the edge controllers that quietly run HVAC, lighting, and energy systems in buildings around the world.\n\nCISA published two advisories on October 1, 2026, covering the EasyIO Neo Series EC and CW controllers, affecting EC firmware V3.3b62 and V3.3b63 and CW firmware V3.3b24 and V3.3b25. The first flaw, CVE-2026-64892, could let an attacker who already has elevated access to the device pull additional sensitive information useful for follow-on attacks; it rates a low 3.5 on the CVSS 3.1 scale. The second, CVE-2026-64893, is a cleartext-transmission bug that lets an attacker on the network intercept credentials and session data sent over unencrypted HTTP; it rates a medium 5.4. Johnson Controls fixed both issues in EC firmware V3.3b64 and CW firmware V3.3b26, and the new version disables HTTP access by default. Researcher Gabriele Gardois reported both bugs.\n\nThese are not niche devices. EasyIO Neo controllers run building systems across critical manufacturing, government facilities, transportation, and energy sites worldwide. A plaintext credential leak on a building automation network sounds low-stakes until you remember these devices often sit near access-control and fire systems on the same segment. CISA says it has not seen either bug exploited in the wild, which is reassuring only until it isn't.\n\nJohnson Controls' fallback advice for anyone who can't patch right away - segment the network, turn on HTTPS, use a VPN - is the same list the building automation industry has been handing out for a decade, which says more about patching cadence in this sector than about the strength of the mitigations.","[\"johnson controls\",\"building automation\",\"ics security\",\"cisa advisory\"]","2026-10-01T12:00:00.000Z","2026-10-02T15:26:58.736Z","2026-10-02T15:27:04.615Z","published",null,[],"security",[26,27,28,29],"johnson controls","building automation","ics security","cisa advisory",[31,34],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-274-04",{"name":32,"url":35},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-274-05",0,{"sections":38},[39,44,48,53,58,63,68,73,78,83,88,93,98,103],{"name":40,"slug":41,"count":42,"latest_published_at":43},"AI","ai",5721,"2026-10-01T19:45:44.000Z",{"name":45,"slug":24,"count":46,"latest_published_at":47},"Security",829,"2026-10-01T17:31:56.000Z",{"name":49,"slug":50,"count":51,"latest_published_at":52},"Policy","policy",437,"2026-10-01T18:10:00.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":57},"Deals","deals",317,"2026-10-01T22:00:00.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Hardware","hardware",198,"2026-10-01T17:38:48.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":67},"Science","science",168,"2026-10-01T18:35:55.000Z",{"name":69,"slug":70,"count":71,"latest_published_at":72},"Consumer Tech","consumer-tech",155,"2026-10-01T19:54:10.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Dev Tools","dev-tools",96,"2026-10-01T16:57:03.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Software","software",93,"2026-09-30T21:41:11.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Startups","startups",90,"2026-10-01T21:55:22.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"Gaming","gaming",53,"2026-10-02T02:50:39.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"General","general",50,"2026-09-30T21:37:54.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":104,"slug":105,"count":106,"latest_published_at":107},"How-To","how-to",7,"2026-10-01T09:00:00.000Z"]