{"id":"CVE-2026-106018","kind":"vulnerability","aliases":["CVE-2026-106018"],"related":[],"title":"Johnson Controls EasyIO FW: authentication bypass through an alternate path","description":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.\n\nThis issue affects EasyIO FW: through 3.0b25.","summary":"Johnson Controls EasyIO FW firmware through 3.0b25 has an authentication bypass via an alternate path or channel (NVD, CVSS 4.0 8.7; vector AV:N/AC:H/PR:H/UI:A). Johnson Controls has not yet published an advisory for this CVE, so the attack path and what access the bypass grants are not documented. Not known to be exploited.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EasyIO FW","fixed":[],"affected":"<= 3.0b25","ecosystem":"vendor"}],"ecosystems":[],"tags":["building-automation","easyio","ics","infrastructure","johnson-controls"],"not_affected_if":["firmware-newer-than-3.0b25"],"how_to_check":"Check the firmware version on each EasyIO FW controller; 3.0b25 and older are in the NVD range. Johnson Controls' FY26 release lists FW V3.0b26 as the current firmware, but it does not say that version fixes this CVE. Confirm with the JCI-PSA advisory or Johnson Controls support before relying on it. Also keep controller web interfaces off the internet.","fix":null,"status":"open","published_at":"2026-11-12T21:17:17+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","triaged_at":"2026-11-12T21:42:21+00:00","updated_at":"2026-11-12T21:43:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T21:42:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Johnson Controls EasyIO FW: authentication bypass through an alternate path","impact":"high","summary":"Johnson Controls EasyIO FW through version 3.0b25 has an authentication bypass flaw that lets an attacker reach functions without logging in. The sources do not describe what the attacker can do after bypassing login.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["johnson-controls","easyio","building-automation","ics"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; authentication can be bypassed on the controller","analyst_note":"Find the vendor advisory for EasyIO FW and confirm the fixed version, attack vector and what access the bypass grants (https://nvd.nist.gov/vuln/detail/CVE-2026-106018).","how_to_check":"- Check the EasyIO FW firmware version on each controller against `3.0b25`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["firmware-newer-than-3.0b25"],"who_is_affected":"EasyIO FW controllers at or below version 3.0b25 are described as affected. The sources do not say how the bypass is reached or which deployments are most exposed. Teams that run Johnson Controls building controllers should check their firmware version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4523,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for EasyIO FW and confirm the fixed version, attack vector and what access the bypass grants (https://nvd.nist.gov/vuln/detail/CVE-2026-106018).","search":"'-106018':13A,16A '-2026':12A,15A '3.0':34B,108C '4.0':48B '8.7':49B 'access':73B 'advisori':63B 'affect':104C 'allow':99C 'altern':9A,42B,89C 'attack':69B 'authent':5A,38B,85C,100C 'autom':21B 'av':51B 'b25':35B,109C 'build':20B 'building-autom':19B 'bypass':6A,39B,75B,86C,101C 'channel':45B,92C 'control':2A,27B,29B,57B,96C 'cve':11A,14A,66B 'cvss':47B 'document':79B 'easyio':3A,17A,22B,30B,97C,105C 'exploit':84B 'firmwar':32B 'fw':4A,18A,31B,98C,106C 'grant':76B 'h/pr':53B 'h/ui':54B 'ic':23B 'infrastructur':24B 'issu':103C 'johnson':1A,26B,28B,56B,95C 'johnson-control':25B 'known':81B 'n/ac':52B 'nvd':46B 'path':10A,43B,70B,90C 'publish':61B 'use':87C 'vector':50B 'via':40B 'vulner':93C 'yet':60B","nicknames":[],"mitigations":[],"who_affected":"Teams that run EasyIO FW building controllers on firmware 3.0b25 or earlier. The vendor has not yet said how the bypass is reached. EasyIO FS, EC, CW and FG controllers are not named for this CVE, so they are not listed here.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["easyiofw","fw"],"ptokens":["easyio","fw"],"labels":["buildingautomation","easyio","high","ics","infrastructure","johnsoncontrols"],"campaign_type":null,"search_a":"'-106018':13A,16A '-2026':12A,15A 'altern':9A 'authent':5A 'bypass':6A 'control':2A 'cve':11A,14A 'easyio':3A,17A 'fw':4A,18A 'johnson':1A 'path':10A","search_b":"'3.0':34B '4.0':48B '8.7':49B 'access':73B 'advisori':63B 'altern':42B 'attack':69B 'authent':38B 'autom':21B 'av':51B 'b25':35B 'build':20B 'building-autom':19B 'bypass':39B,75B 'channel':45B 'control':27B,29B,57B 'cve':66B 'cvss':47B 'document':79B 'easyio':22B,30B 'exploit':84B 'firmwar':32B 'fw':31B 'grant':76B 'h/pr':53B 'h/ui':54B 'ic':23B 'infrastructur':24B 'johnson':26B,28B,56B 'johnson-control':25B 'known':81B 'n/ac':52B 'nvd':46B 'path':43B,70B 'publish':61B 'vector':50B 'via':40B 'yet':60B","search_c":"'3.0':108C 'affect':104C 'allow':99C 'altern':89C 'authent':85C,100C 'b25':109C 'bypass':86C,101C 'channel':92C 'control':96C 'easyio':97C,105C 'fw':98C,106C 'issu':103C 'johnson':95C 'path':90C 'use':87C 'vulner':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T21:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106018","severity":null,"published_at":"2026-11-12T21:17:17+00:00","modified_at":"2026-11-12T21:17:17+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","fetched_at":"2026-11-12T21:40:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106018:3787","url":"https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content","severity":null,"published_at":"2026-11-12T21:43:51+00:00","modified_at":"2026-11-12T21:43:51+00:00","first_seen_at":"2026-11-12T21:43:51+00:00","fetched_at":"2026-11-12T21:43:51+00:00","note":"No JCI advisory for this CVE on the JCI advisories page yet (checked 2026-11-12); NVD (assigner JCI) says FW through 3.0b25. FY26 release notes list FW V3.0b26 as the 2026 firmware but do not mention this CVE, so the fix is unconfirmed. Revisit when the JCI-PSA appears.","cites":["https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content"]}],"documents":[{"id":139458,"url":"https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content","title":"EasyIO FY26 Release (FW V3.0b26 firmware)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}