Johnson Controls EasyIO Neo IO Manager and Tools Installer search order hijacking flaw
An attacker can slip fake files into this building equipment manager.
Summary
In EasyIO Neo IO Manager and Tools Installer version 1.1.0.0, an attacker can swap in a file that the program loads instead of the real one. The advisory gives no further detail on the scope.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen