EasyIO Neo EC and CW Edge Controller authentication bypass
Building controllers can be entered without a login.
Summary
Johnson Controls' EasyIO Neo EC and CW Edge Controller building controllers can be reached through an alternate path that skips login. EC 3.3b62 through 3.3b63 and CW 3.3b24 through 3.3b25 are affected.
What to do
No fixed version is named in the sources. Check that the controller runs a version newer than EC 3.3b63 or CW 3.3b25, and read the vendor's advisory.
Update these devices now.
- Johnson Controls EasyIO Neo EC
- Johnson Controls EasyIO CW Edge Controller
Products and platforms
CVE IDs
Times
First published
First seen