Johnson Controls EasyIO FG

CISA published an ICS advisory (ICSA-26-279-01) regarding two HIGH severity vulnerabilities in Johnson Controls EasyIO FG firmware versions <=2.0b52. The vulnerabilities CVE-2026-27872 (Use of Hard-coded Credentials, CWE-798) and CVE-2026-27873 (Improper Privilege Management, CWE-269) could allow an attacker to gain full unauthorized access to the device. Both CVEs carry a CVSS v3.1 score of 7.7 (HIGH) and CVSS 4.0 score of 7.2 (HIGH). The affected product has reached End-of-Life and End-of-Support status, with no firmware patch available, as it has not been manufactured or sold since prior to 2019. Users are advised to migrate to EasyIO Neo R1 Series. Mitigations include network isolation, VLAN segmentation, disabling insecure services, IP whitelisting, and centralized monitoring. No known public exploitation has been reported, and the vulnerabilities are not exploitable remotely. Affected critical infrastructure sectors include Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy.