EASYIO FW · CVE-2026-106018 · Infrastructure
NO FIX YET
Johnson Controls EasyIO FW firmware through 3.0b25 has an authentication bypass via an alternate path or channel (NVD, CVSS 4.0 8.7; vector AV:N/AC:H/PR:H/UI:A). Johnson Controls has not yet published an advisory for this CVE, so the attack path and what access the bypass grants are not documented. Not known to be exploited.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run EasyIO FW building controllers on firmware 3.0b25 or earlier. The vendor has not yet said how the bypass is reached. EasyIO FS, EC, CW and FG controllers are not named for this CVE, so they are not listed here.
Not affected if firmware-newer-than-3.0b25
Who cares building-automation, easyio, ics, johnson-controls
Unknown from the sources.
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.
This issue affects EasyIO FW: through 3.0b25.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.