Inclusion of Functionality from Untrusted Control Sphere in Johnson Controls EasyIO Neo IOManager and Tools Installer
CVE-2026-64894

7.3HIGH

Key Information:

Vendor

Johnson Controls

Status
Easyio Neo Iomanager And Tools Installer
Vendor
CVE Published:
6 November 2026

What is CVE-2026-64894?

A vulnerability exists in Johnson Controls' EasyIO Neo IOManager and Tools Installer that allows for the inclusion of functionality from untrusted control spheres. This could allow an attacker to manipulate software updates, potentially leading to the installation of malicious software. Users of version 1.1.0.0 should take precautions to safeguard their systems against unauthorized updates and review security practices.

Affected Version(s)

EasyIO Neo IOManager and Tools Installer 1.1.0.0

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.