CVE-2026-27873

Received Received - Intake

Hard-Coded Credentials in Johnson Controls EasyIO FG

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Johnson Controls

Description

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-27873

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	easyio_fg	to 2.0b52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves hard-coded credentials in Johnson Controls EasyIO FG software versions before 2.0b52. Attackers could exploit this to perform password spraying attacks, potentially gaining unauthorized access to the system.

Impact Analysis

An attacker exploiting this could gain control over the EasyIO FG system, leading to unauthorized access, data breaches, or disruption of building automation systems. This may affect physical security and operational integrity.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face legal penalties, fines, and reputational damage.

Mitigation Strategies

Update EasyIO FG to version 2.0b52 or later to address the hard-coded credentials vulnerability. Ensure no default or hard-coded credentials are used in the system configuration.

Hi! I’m here to help you understand CVE-2026-27873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70