Sensitive Information Exposure in Johnson Controls Easy IO Neo
CVE-2026-64892

6.3MEDIUM

Key Information:

Vendor

Johnson Controls

Status
Easy Io Neo
Vendor
CVE Published:
1 October 2026

What is CVE-2026-64892?

The Easy IO Neo product from Johnson Controls suffers from a vulnerability that permits unauthorized access to sensitive information by allowing data collection from common resource locations. This exposure can potentially lead to adverse impacts on users and systems relying on the affected product. Users are advised to upgrade to version 3.3b63 or later to mitigate this risk.

Affected Version(s)

Easy IO Neo 0 < 3.3b63

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.