CVE-2026-27873

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-02

Assigner: Johnson Controls

Description

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-27873

EUVD

EUVD-2026-91075

Affected Vendors & Products

Vendor	Product	Version / Range
Johnson	Controls	EasyIO FG 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves hard-coded credentials in Johnson Controls EasyIO FG software versions before 2.0b52. Attackers could exploit this to perform password spraying attacks, potentially gaining unauthorized access to the system.

Detection Guidance

This vulnerability involves hard-coded credentials in Johnson Controls EasyIO FG devices before version 2.0b52. Detection requires checking device firmware versions and inspecting network traffic for unauthorized access attempts using default credentials. No specific commands are provided in the available context.

Impact Analysis

An attacker exploiting this could gain control over the EasyIO FG system, leading to unauthorized access, data breaches, or disruption of building automation systems. This may affect physical security and operational integrity.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face legal penalties, fines, and reputational damage.

Mitigation Strategies

Update EasyIO FG to version 2.0b52 or later to address the hard-coded credentials vulnerability. Ensure no default or hard-coded credentials are used in the system configuration.

Hi! I’m here to help you understand CVE-2026-27873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70