CVE-2026-64893

Received Received - Intake

Cleartext Transmission of Sensitive Data in Johnson Controls EasyIO NEO

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Johnson Controls

Description

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-64893

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	easyio_neo	to 3.3b25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves sensitive information being transmitted in cleartext by Johnson Controls EasyIO NEO, allowing a Man In the Middle Attack. It affects versions before 3.3b25.

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for cleartext transmission of sensitive data. Use packet capture tools like tcpdump or Wireshark to inspect traffic from EasyIO NEO devices. Look for unencrypted credentials or configuration data. Ensure devices are updated to version 3.3b25 or later to address this issue.

Impact Analysis

An attacker could intercept sensitive data during transmission, leading to unauthorized access or data breaches. This may expose confidential information or allow manipulation of system communications.

Compliance Impact

This vulnerability likely violates data protection requirements in GDPR and HIPAA, as cleartext transmission of sensitive data fails to meet encryption and security standards mandated by these regulations.

Mitigation Strategies

Immediately update EasyIO NEO devices to version 3.3b25 or later. Isolate affected devices from untrusted networks. Implement network segmentation to limit exposure. Monitor network traffic for suspicious activity and enforce encrypted communication protocols where possible.

Hi! I’m here to help you understand CVE-2026-64893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70