Critical Hard‑Coded Credential & Privilege‑Management Flaws in Johnson Controls EasyIO FG Firmware (CVE‑2026‑27872, CVE‑2026‑27873)
What It Is – Two high‑severity vulnerabilities (CVSS 7.7) in Johnson Controls EasyIO FG firmware ≤ 2.0b52 allow an attacker to log in with hard‑coded credentials and bypass privilege checks, leading to full device compromise.
Exploitability – Publicly disclosed; proof‑of‑concept code has not been released, but the flaws are trivial to exploit once the firmware is accessed. No known active exploits in the wild yet.
Affected Products – Johnson Controls EasyIO FG series (building‑automation controllers) running firmware ≤ 2.0b52. The product is EOL/EOS; source code is unavailable.
Why It Matters for Trust & Control Assurance
- Identity & Access Controls – Hard‑coded credentials defeat any least‑privilege model, eroding the control objective of managing privileged access.
- Lifecycle Management – An EOL device that cannot be patched highlights gaps in firmware‑version tracking and evidence of continuous monitoring.
- Audit Readiness – Demonstrating that all critical‑infrastructure assets are covered by up‑to‑date access‑control policies is a core trust signal for auditors and enterprise buyers.
Recommended Actions
- Inventory all EasyIO FG devices and verify firmware versions.
- Immediately isolate any unit running ≤ 2.0b52 and replace with supported hardware or apply compensating network segmentation.
- Document the removal of hard‑coded credentials from your asset register and map the remediation to the “access control” control objective in your framework of record (e.g., NIST CSF 2.0).
Source: CISA Advisory – ICSA‑26‑279‑01