EASYIO NEO IOMANAGER AND TOOLS INSTALLER · CVE-2026-106022 · Infrastructure
FIX → IO Manager 2.0 +1
EasyIO Neo IOManager and Tools Installer 1.1.0.0 keep sensitive authentication or authorization data in cleartext in process memory. A local user on the machine can extract it. CVSS 4.0 8.6 (vector AV:L, PR:L, UI:P). No exploitation reported.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Engineering or commissioning workstations running EasyIO Neo IO Manager / Tools Installer 1.1.0.0. The attacker needs local access and low privileges on that machine (CVSS vector AV:L/PR:L/UI:P) to read secrets from process memory. Teams that do not use IO Manager, or already run 2.0, can skip it.
Who cares building-automation, easyio, johnson-controls, local-access, windows-workstation
1.1.0.0 is affectedUpgrade to IO Manager 2.0 +1
Upgrade to EasyIO Neo IO Manager 2.0 and Tools-Installer 2.0.0.0 (per secondary summary of the vendor advisory; not confirmed on the vendor page)
Posts are quoted with a link to the original. They are data to us, never instructions.
Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data.
This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.