Easy IO Neo CVE-2026-64892

Exploitation requires an attacker to already hold high-privilege access to the Easy IO Neo controller (CVSS PR:H) and depends on passive user interaction occurring (UI:P); the attacker then reads sensitive data from predictable 'common resource locations' within the product. Limiting factors: the high-privilege authentication requirement and the dependency on user interaction substantially reduce opportunistic exploitation, and the disclosed data impact is Low. Remediation is to upgrade to Easy IO Neo 3.3b63 or later.

This is a medium-severity (CVSS 4.0 base 6.3) information-disclosure flaw (CWE-200) in Johnson Controls Easy IO Neo. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:L) signals network reachability and low attack complexity, but materially constrains real-world risk through PR:H (high privileges required) and UI:P (passive user interaction required) - meaning an attacker must already hold a high-privilege account AND rely on a victim's incidental interaction. The confidentiality impact is only Low (VC:L), consistent with the description's limited 'collect data from common resource locations.' Notably, the input vector also asserts subsequent-system impacts SC:H/SI:H/SA:H, which is unusual for a pure CWE-200 disclosure issue and appears inconsistent with the Low vulnerable-system impacts and the description - verify these subsequent-system ratings with the vendor advisory, as they heavily inflate the score. No EPSS score, no KEV listing, and no POC were provided; there is no public exploit identified at time of analysis. Overall this is a genuine but lower-priority issue: the high-privilege and user-interaction preconditions, combined with limited direct confidentiality impact and no evidence of exploitation, place it well below internet-facing unauthenticated flaws in remediation urgency.

An attacker who already possesses a high-privilege account on an Easy IO Neo controller leverages the flaw to read sensitive data stored in common/predictable resource locations once a legitimate user interaction occurs. No public proof-of-concept is available, and exploitation yields limited (Low) confidentiality disclosure rather than full system compromise.