Live › vulnerability › CVE-2026-71450
Johnson Controls EasyIO Neo EC and CW Edge Controller building-automation devices have an authentication bypass flaw that lets an attacker skip login through an alternate path or channel. The sources list the affected builds as EC 3.3b62 through EC 3.3b63 and CW 3.3b24 through CW 3.3b25.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:35 UTC. All times on this page are UTC.
Buildings running Johnson Controls EasyIO Neo EC or CW controllers on the listed builds. Exposure grows if the controller web interface is reachable beyond a trusted management network. The vendor has not yet published details, so teams on other builds cannot yet be ruled in or out.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| EasyIO Neo EC | vendor | EC 3.3b62 through EC 3.3b63 | – |
| EasyIO Neo CW Edge Controller | vendor | CW 3.3b24 through CW 3.3b25 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.
This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.
This page as .md · .json · in your agent: get_signal("CVE-2026-71450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.