{"id":"CVE-2026-71450","kind":"vulnerability","aliases":["CVE-2026-71450"],"related":[],"title":"Johnson Controls EasyIO building controllers: authentication bypass through alternate path","description":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.\n\nThis issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.","summary":"Johnson Controls EasyIO Neo EC and CW Edge Controller building-automation devices have an authentication bypass flaw that lets an attacker skip login through an alternate path or channel. The sources list the affected builds as EC 3.3b62 through EC 3.3b63 and CW 3.3b24 through CW 3.3b25.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EasyIO Neo EC","fixed":[],"affected":"EC 3.3b62 through EC 3.3b63","ecosystem":"vendor"},{"name":"EasyIO Neo CW Edge Controller","fixed":[],"affected":"CW 3.3b24 through CW 3.3b25","ecosystem":"vendor"}],"ecosystems":[],"tags":["building-automation","easyio","ics","infrastructure","johnson-controls","ot"],"not_affected_if":["network-isolated","unaffected-firmware"],"how_to_check":"Check controller firmware: EC builds 3.3b62 or 3.3b63, CW builds 3.3b24 or 3.3b25 are in the NVD affected range. Also check whether the controller web interface is reachable from untrusted networks. The vendor has not yet described the alternate path.","fix":null,"status":"open","published_at":"2026-11-02T23:17:21+00:00","first_seen_at":"2026-11-02T23:35:57+00:00","triaged_at":"2026-11-02T23:36:36+00:00","updated_at":"2026-11-02T23:38:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T23:36:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Johnson Controls EasyIO building controllers: authentication bypass through alternate path","impact":"high","summary":"Johnson Controls EasyIO Neo EC and CW Edge Controller building-automation devices have an authentication bypass flaw that lets an attacker skip login through an alternate path or channel. The sources list the affected builds as EC 3.3b62 through EC 3.3b63 and CW 3.3b24 through CW 3.3b25.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["easyio","johnson-controls","building-automation","ot","ics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses login and controls the building controller","analyst_note":"Find the vendor advisory for the fixed firmware version and the exact alternate path; the NVD entry alone does not state either.","how_to_check":"- Check the controller firmware version on the device or in its management interface for EC builds `3.3b62` to `3.3b63` and CW builds `3.3b24` to `3.3b25`\n- Confirm whether the controller's web or network interface is reachable from untrusted networks (unknown from sources)","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-firmware","network-isolated"],"who_is_affected":"Sites running EasyIO Neo EC or CW Edge Controller building-automation hardware on the affected firmware builds are exposed. Controllers that are not on the affected builds, or that are isolated from untrusted networks, are less exposed; the sources do not describe the specific alternate path or the required network position.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4159,"output_tokens":617,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for the fixed firmware version and the exact alternate path; the NVD entry alone does not state either.","search":"'-2026':12A,15A '-71450':13A,16A '3.3':73B,77B,81B,85B,121C,125C,130C,134C 'affect':69B,111C 'allow':106C 'altern':9A,61B,91C 'attack':56B 'authent':6A,50B,87C,107C 'autom':27B,46B 'b24':82B,131C 'b25':86B,135C 'b62':74B,122C 'b63':78B,126C 'build':4A,26B,45B,70B 'building-autom':25B,44B 'bypass':7A,51B,88C,108C 'channel':64B,94C 'control':2A,5A,33B,36B,43B,98C,105C,118C 'controller':24A 'cve':11A,14A 'cw':22A,41B,80B,84B,103C,116C,129C,133C 'devic':47B 'easyio':3A,17A,20A,28B,37B,99C,112C 'ec':19A,39B,72B,76B,101C,114C,120C,124C 'edg':42B,104C,117C 'edge':23A 'flaw':52B 'ic':29B 'infrastructur':30B 'issu':110C 'johnson':1A,32B,35B,97C 'johnson-control':31B 'let':54B 'list':67B 'login':58B 'neo':18A,21A,38B,100C,113C 'ot':34B 'path':10A,62B,92C 'skip':57B 'sourc':66B 'use':89C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Buildings running Johnson Controls EasyIO Neo EC or CW controllers on the listed builds. Exposure grows if the controller web interface is reachable beyond a trusted management network. The vendor has not yet published details, so teams on other builds cannot yet be ruled in or out.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["easyioneocwedgecontroller","easyioneoec","neocwedgecontroller","neoec"],"ptokens":["controller","cw","easyio","ec","edge","neo"],"labels":["buildingautomation","easyio","high","ics","infrastructure","johnsoncontrols","ot"],"first_public_at":"2026-11-02T23:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71450","severity":null,"published_at":"2026-11-02T23:17:21+00:00","modified_at":"2026-11-02T23:17:21+00:00","first_seen_at":"2026-11-02T23:35:57+00:00","fetched_at":"2026-11-02T23:35:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-71450:1440","url":null,"severity":null,"published_at":"2026-11-02T23:38:11+00:00","modified_at":"2026-11-02T23:38:11+00:00","first_seen_at":"2026-11-02T23:38:11+00:00","fetched_at":"2026-11-02T23:38:11+00:00","note":"NVD (CNA: Johnson Controls) gives affected range only. JCI advisory index (checked Nov 2) has no entry for CVE-2026-71450 yet; no vendor text on the alternate path or the fix. Sibling EasyIO Neo advisories (JCI-PSA-2026-19/20/30, other CVEs, same builds) are fixed in EC V3.3b64 / CW V3.3b26 per CISA, but that is NOT confirmed for this CVE. Nothing verified. Revisit when JCI or CISA publishes."}],"documents":[{"id":54500,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71450","title":"NVD CVE-2026-71450","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":54501,"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","title":"Johnson Controls Product Security Advisories index","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}