---
id: "CVE-2026-71450"
kind: "vulnerability"
aliases: ["CVE-2026-71450"]
title: "Johnson Controls EasyIO building controllers: authentication bypass through alternate path"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EasyIO Neo EC", "fixed": [], "affected": "EC 3.3b62 through EC 3.3b63", "ecosystem": "vendor"}, {"name": "EasyIO Neo CW Edge Controller", "fixed": [], "affected": "CW 3.3b24 through CW 3.3b25", "ecosystem": "vendor"}]
ecosystems: []
tags: ["building-automation", "easyio", "ics", "infrastructure", "johnson-controls", "ot"]
not_affected_if: ["network-isolated", "unaffected-firmware"]
published_at: "2026-11-02T23:17:21+00:00"
first_seen_at: "2026-11-02T23:35:57+00:00"
updated_at: "2026-11-02T23:38:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71450", "first_seen_at": "2026-11-02T23:35:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T23:38:11+00:00"}]
---

# Johnson Controls EasyIO building controllers: authentication bypass through alternate path

Johnson Controls EasyIO Neo EC and CW Edge Controller building-automation devices have an authentication bypass flaw that lets an attacker skip login through an alternate path or channel. The sources list the affected builds as EC 3.3b62 through EC 3.3b63 and CW 3.3b24 through CW 3.3b25.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EasyIO Neo EC affected EC 3.3b62 through EC 3.3b63 fixed ?
- vendor:EasyIO Neo CW Edge Controller affected CW 3.3b24 through CW 3.3b25 fixed ?

## How to check

Check controller firmware: EC builds 3.3b62 or 3.3b63, CW builds 3.3b24 or 3.3b25 are in the NVD affected range. Also check whether the controller web interface is reachable from untrusted networks. The vendor has not yet described the alternate path.

## Timeline

- 2026-11-02T23:35:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71450
- 2026-11-02T23:38:11+00:00 analyst — NVD (CNA: Johnson Controls) gives affected range only. JCI advisory index (checked Nov 2) has no entry for CVE-2026-71450 yet; no vendor text on the alternate path or the fix. Sibling EasyIO Neo advisories (JCI-PSA-2026-19/20/30, other CVEs, same builds) are fixed in EC V3.3b64 / CW V3.3b26 per CISA, but that is NOT confirmed for this CVE. Nothing verified. Revisit when JCI or CISA publishes.

## Documents

- [describes] NVD CVE-2026-71450 https://nvd.nist.gov/vuln/detail/CVE-2026-71450
- [mentions] Johnson Controls Product Security Advisories index https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

## From the sources

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.

This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_