EasyIO NEO CVE-2026-64893

Exploitation requires the attacker to achieve a man-in-the-middle position on the network path used by EasyIO NEO (versions before 3.3b25), because sensitive information is transmitted without encryption (CWE-319). Limiting factors per the CVSS 4.0 vector: HIGH attack complexity (AC:H) and a present attack requirement (AT:P) mean the attacker must control or intercept the communication channel; low privileges (PR:L) are needed; and user/passive interaction (UI:P) is required, so a victim-side transmission must occur for sensitive data to be captured. This is not remote-unauthenticated exploitation against default configurations - it is gated by network positioning and interaction.

This is a moderate, context-dependent risk rather than a top-tier emergency. The only severity signal provided is a vendor-supplied (jci/Johnson Controls) CVSS 4.0 base score of 7.3 with vector AV:N/AC:H/AT:P/PR:L/UI:P - meaning that while the vector is network-reachable, exploitation carries HIGH attack complexity (AC:H), a specific attack requirement (AT:P), requires low-level privileges (PR:L), and depends on user/passive interaction (UI:P). These modifiers collectively indicate a non-trivial, situational attack - consistent with a man-in-the-middle (CWE-319 cleartext transmission) scenario where the attacker must already occupy a privileged network position on the path between victim endpoints. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Note a tension worth flagging: AV:N implies remote reachability, but a cleartext/MITM flaw realistically requires network-adjacent interception positioning, which is why AC:H is appropriate - the 'network' vector does not mean trivial internet-wide exploitation. Given EasyIO NEO is a niche building-automation/HVAC controller rather than ubiquitous software, this should be prioritized by operators of affected OT/BMS environments but does not warrant emergency cross-industry response.

An attacker who has gained a foothold on the same operational-technology/building-automation network segment as an EasyIO NEO controller positions themselves as a man-in-the-middle on the communication path. Because sensitive information is transmitted in cleartext, the attacker passively intercepts or actively relays traffic to capture credentials or configuration data exchanged with the controller. No public exploit code was identified, and the attack requires both a privileged network position and victim-side interaction, limiting opportunistic use.