Authentication Bypass Vulnerability in Johnson Controls EasyIO FW
CVE-2026-106018

8.7HIGH

Key Information:

Vendor

Johnson Controls

Status
Easyio Fw
Vendor
CVE Published:
12 November 2026

What is CVE-2026-106018?

An authentication bypass vulnerability has been identified in Johnson Controls EasyIO FW, allowing attackers to gain unauthorized access through an alternate path or channel. This flaw impacts versions of EasyIO FW up to 3.0b25. Organizations using this product should take immediate steps to apply available security patches and ensure comprehensive security measures to prevent potential exploitation.

Affected Version(s)

EasyIO FW 0 <= 3.0b25

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.