{"id":"CVE-2026-64894","kind":"vulnerability","aliases":["CVE-2026-64894"],"related":[],"title":"Johnson Controls EasyIO Neo IOManager: untrusted update source lets malicious software install","description":"Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update.\n\nThis issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.","summary":"NVD and Johnson Controls (JCI-PSA-2026-15) list EasyIO Neo IOManager and Tools Installer 1.1.0.0 as affected by a malicious software update flaw. A secondary summary describes it as replacement of unsigned binaries or libraries. The CVSS 4.0 vector is physical access, high complexity, with user interaction. No exploitation is reported.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EasyIO Neo IOManager and Tools Installer","fixed":["IO Manager 2.0","Tools-Installer 2.0.0.0"],"affected":"1.1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["building-automation","easyio","infrastructure","iomanager","johnson-controls"],"not_affected_if":["io-manager-2.0","other-versions"],"how_to_check":"Check the installed EasyIO Neo IO Manager and Tools Installer version. 1.1.0.0 is the affected version; IO Manager 2.0 / Tools-Installer 2.0.0.0 is the reported fix. JCI's uninstall steps reportedly refer to 1.0.0.0, so confirm with Johnson Controls whether 1.0.0.0 is also affected.","fix":"Per a secondary summary of JCI-PSA-2026-15: upgrade to IO Manager 2.0 and Tools-Installer 2.0.0.0. Not confirmed on the vendor page.","status":"open","published_at":"2026-11-06T15:17:22+00:00","first_seen_at":"2026-11-06T15:42:45+00:00","triaged_at":"2026-11-06T15:44:18+00:00","updated_at":"2026-11-06T15:45:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T15:44:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Johnson Controls EasyIO Neo IOManager: untrusted update source lets malicious software install","impact":"high","summary":"EasyIO Neo IOManager and Tools Installer version 1.1.0.0 includes functionality from an untrusted control sphere, so a malicious software update can be delivered. An attacker who gets a malicious update accepted can run code on the building automation system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["johnson-controls","easyio","building-automation","iomanager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"malicious code installed through a fake software update","analyst_note":"Check the NVD entry and the Johnson Controls advisory for the update mechanism, reach, and any fixed version.","how_to_check":"- Check the installed IOManager and Tools Installer version against `1.1.0.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Sites running EasyIO Neo IOManager and Tools Installer version 1.1.0.0 are affected, since the flaw is in how that version accepts updates. The sources do not say how updates are delivered or which configurations are exposed. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4228,"output_tokens":500,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Johnson Controls advisory for the update mechanism, reach, and any fixed version.","search":"'-15':42B '-2026':14A,17A '-64894':15A,18A '1.1.0.0':50B,117C '2026':41B '4.0':73B 'access':77B 'affect':52B,110C 'allow':104C 'and':22A 'autom':27B 'binari':68B 'build':26B 'building-autom':25B 'complex':79B 'control':2A,33B,37B,92C,97C 'cve':13A,16A 'cvss':72B 'describ':62B 'easyio':3A,19A,28B,44B,98C,111C 'exploit':84B 'flaw':58B 'function':89C 'high':78B 'inclus':87C 'infrastructur':29B 'instal':12A,49B,103C,116C 'installer':24A 'interact':82B 'iomanag':5A,30B,46B,100C,113C 'iomanager':21A 'issu':109C 'jci':39B 'jci-psa':38B 'johnson':1A,32B,36B,96C 'johnson-control':31B 'let':9A 'librari':70B 'list':43B 'malici':10A,55B,105C 'neo':4A,20A,45B,99C,112C 'nvd':34B 'physic':76B 'psa':40B 'replac':65B 'report':86B 'secondari':60B 'softwar':11A,56B,106C 'sourc':8A 'sphere':93C 'summari':61B 'tool':48B,102C,115C 'tools':23A 'unsign':67B 'untrust':6A,91C 'updat':7A,57B,107C 'user':81B 'vector':74B 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":"Teams running EasyIO Neo IO Manager / Tools Installer 1.1.0.0 on engineering or commissioning workstations that configure building controllers. Exposure needs physical or local access and a user accepting the update, per the CVSS vector. Anyone not using the IO Manager tool, or already on IO Manager 2.0, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["easyioneoiomanagerandtoolsinstaller","neoiomanagerandtoolsinstaller"],"ptokens":["and","easyio","installer","iomanager","neo","tools"],"labels":["buildingautomation","easyio","high","infrastructure","iomanager","johnsoncontrols"],"campaign_type":null,"search_a":"'-2026':14A,17A '-64894':15A,18A 'and':22A 'control':2A 'cve':13A,16A 'easyio':3A,19A 'instal':12A 'installer':24A 'iomanag':5A 'iomanager':21A 'johnson':1A 'let':9A 'malici':10A 'neo':4A,20A 'softwar':11A 'sourc':8A 'tools':23A 'untrust':6A 'updat':7A","search_b":"'-15':42B '1.1.0.0':50B '2026':41B '4.0':73B 'access':77B 'affect':52B 'autom':27B 'binari':68B 'build':26B 'building-autom':25B 'complex':79B 'control':33B,37B 'cvss':72B 'describ':62B 'easyio':28B,44B 'exploit':84B 'flaw':58B 'high':78B 'infrastructur':29B 'instal':49B 'interact':82B 'iomanag':30B,46B 'jci':39B 'jci-psa':38B 'johnson':32B,36B 'johnson-control':31B 'librari':70B 'list':43B 'malici':55B 'neo':45B 'nvd':34B 'physic':76B 'psa':40B 'replac':65B 'report':86B 'secondari':60B 'softwar':56B 'summari':61B 'tool':48B 'unsign':67B 'updat':57B 'user':81B 'vector':74B","search_c":"'1.1.0.0':117C 'affect':110C 'allow':104C 'control':92C,97C 'easyio':98C,111C 'function':89C 'inclus':87C 'instal':103C,116C 'iomanag':100C,113C 'issu':109C 'johnson':96C 'malici':105C 'neo':99C,112C 'softwar':106C 'sphere':93C 'tool':102C,115C 'untrust':91C 'updat':107C 'vulner':94C","first_public_at":"2026-11-06T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64894","severity":null,"published_at":"2026-11-06T15:17:22+00:00","modified_at":"2026-11-06T15:17:22+00:00","first_seen_at":"2026-11-06T15:42:45+00:00","fetched_at":"2026-11-06T15:42:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-64894:1904","url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","severity":null,"published_at":"2026-11-06T15:45:23+00:00","modified_at":"2026-11-06T15:45:23+00:00","first_seen_at":"2026-11-06T15:45:23+00:00","fetched_at":"2026-11-06T15:45:23+00:00","note":"Vendor advisory JCI-PSA-2026-15 (Nov 3 2026) is listed on JCI's index, but I could not open the advisory text itself; fix and details come from a Viakoo summary, so nothing is marked verified. Not exploited per that summary. To settle: read JCI-PSA-2026-15 itself.","cites":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/"]}],"documents":[{"id":54501,"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","title":"Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":87608,"url":"https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/","title":"Daily OT Security News: November 05, 2026 (Viakoo)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}