Vulnerability details

CVE-2026-71450

Johnson Controls EasyIO Neo EC and CW Edge Controller

CVSS 4.0

8.7High

Official description

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (jci)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Affected products

Vendor	Product	Versions	Source
Johnson Controls	EasyIO Neo EC and CW Edge Controller	CW 3.3b24 ≤ v ≤ CW 3.3b25	CVEProject cvelistV5 (CNA)
Johnson Controls	EasyIO Neo EC and CW Edge Controller	EC 3.3b62 ≤ v ≤ EC 3.3b63	CVEProject cvelistV5 (CNA)

References and advisories

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-03
Last updated: 2026-11-06
State: Published
Assigner (CNA): jci

Exploit prediction (EPSS)

0.28%

Probability of exploitation in 30 days

20.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-288
Authentication bypass using an alternate path or channel