Key facts
- CISA published an ICS advisory on two vulnerabilities in Johnson Controls EasyIO FG firmware; it says successful exploitation could give an attacker full unauthorized access to the device.
- The affected firmware is EasyIO FG version 2.0b52 and earlier, and the two flaws are tracked as CVE-2026-27872 and CVE-2026-27873.
- CISA reports no known public exploitation targeting these flaws. It says they have high attack complexity and are not remotely exploitable.
- S2 describes both flaws as involving hard-coded credentials and improper privilege management, which could lead to full device compromise.
CISA published an industrial control systems advisory, ICSA-26-279-01, on Oct. 6, 2026, covering two vulnerabilities in Johnson Controls EasyIO FG firmware. The agency says successful exploitation could give an attacker full unauthorized access to the device.
The affected firmware is EasyIO FG version 2.0b52 and earlier. The flaws are tracked as CVE-2026-27872 and CVE-2026-27873. ISSSource, the trade outlet that covered the advisory, reports that Johnson Controls will not issue a firmware patch because the product line is end-of-life. That detail comes from ISSSource, not from CISA’s advisory as reviewed for this report.
Weaknesses and severity
ISSSource describes the pair of flaws together as involving hard-coded credentials, meaning passwords built into the firmware, and improper privilege management, which could lead to full device compromise. It does not break down which weakness applies to each CVE.
The aggregator OpenCVE does make a mapping for one of them: it lists CVE-2026-27873 as CWE-798, the weakness category for use of hard-coded credentials. That entry points to password spraying, where an attacker tries common or known passwords against many accounts.
ISSSource gives each CVE a CVSS v3 base score of 7.7 and a CVSS v4 base score of 7.2. CVSS is the standard severity rating system for vulnerabilities.
OpenCVE lists CVE-2026-27873 with a CVSS of 5.6 and says it is not in CISA’s Known Exploited Vulnerabilities catalog. It also says firmware older than 2.0b52 is affected. That conflicts with ISSSource’s scores and with CISA’s ‘and earlier’ wording, and the sources do not resolve the discrepancy.
No patch, according to ISSSource
ISSSource reports that the EasyIO FG series is end-of-life and end-of-support. It says Johnson Controls has not made or sold the line since before 2019 and no longer has the source code, so no firmware patch will be issued.
ISSSource says users should migrate to current products such as EasyIO Neo R1. The vendor’s own advisory, JCI-PSA-2026-12, was not reviewed for this report, so these details rest on ISSSource’s account of it.
What the devices do and where they sit
EasyIO FG is a legacy line of IP-connected controllers for building energy management and automation, including the FG-32+ model. They monitor and control HVAC and other building systems. These are operational technology (OT) devices: they run physical equipment rather than office IT.
CISA and ISSSource list the product’s use in the Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy sectors. It is deployed worldwide. Johnson Controls is headquartered in Ireland.
Exploitation status
CISA reports no known public exploitation targeting these flaws. It also says they have high attack complexity and are not remotely exploitable. The sources do not report any service disruption tied to them.
CISA credits Gabriele Gardois, Zachary Bushell and Lorenzo De Carli of the University of Calgary in Canada with reporting the flaws to Johnson Controls.
What operators can do
CISA advises minimizing network exposure, placing control systems behind firewalls and isolating them from business networks. For remote access, it recommends VPNs, kept updated. Per ISSSource’s summary, the vendor advisory JCI-PSA-2026-12 recommends the following measures:
- Keep OT networks isolated and off the internet
- Use VLAN segmentation and allowlisted IP addresses
- Disable insecure services such as Telnet
- Monitor for repeated login attempts and root access
Why it matters
If ISSSource’s account is accurate, owners of these controllers have no firmware fix to wait for. They depend on network isolation or replacement, and the line has reportedly not been made or sold since before 2019.
The affected sectors include energy, transportation and government facilities. Operators should confirm firmware versions and check the vendor advisory directly.
Join the discussion