Neo Series MVP2 EUVD-2026-91071

Exploitation targets the device's on-chip debug/test interface (CWE-1191) on Neo Series MVP2 units running firmware before 3.3b63, so an exposed or improperly access-controlled hardware debug port is the core prerequisite. Despite the vendor's AV:N rating, the on-chip debug nature strongly implies the attacker needs local or physical access to the debug interface rather than purely remote network reach. Exploitation is further limited by high attack complexity (AC:H) and required active user interaction (UI:A per the supplied vector); devices updated to 3.3b63 or later are not affected. Defenders should treat physically secured, network-isolated controllers as substantially lower risk.

Signals are mixed and point to a lower real-world priority than the 7.2 CVSS 4.0 base score suggests. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H) claims a network attack vector, but the vulnerability class - CWE-1191 (on-chip debug/test interface with improper access control) - and the description ('On-Chip Debug Interface vulnerability') strongly imply local or physical access to a hardware debug port (e.g. JTAG/SWD), not remote network exploitation. This is a notable conflict: AV:N appears inconsistent with an on-chip debug flaw and should be verified with Johnson Controls. The vector also combines high attack complexity (AC:H) with required active user interaction (UI:A), both of which further limit practical exploitation. No EPSS score, no CISA KEV listing, and no POC were provided in the input, consistent with no public exploit identified at time of analysis. There is also an internal description/metric tension: the description says data can be collected (information disclosure), yet the vector sets vulnerable-system confidentiality VC:N while placing confidentiality/integrity/availability impact on subsequent systems (SC:H/SI:H/SA:H) plus VA:H - verify the intended impact with the vendor. Net: a legitimately severe hardware-level issue for affected devices, but the combination of likely physical/local access, high complexity, required interaction, niche product footprint, and absence of exploitation evidence makes this a moderate, non-urgent priority for most fleets - prioritized by whether Neo Series MVP2 units are physically exposed.

An attacker with physical or local access to a Johnson Controls Neo Series MVP2 device (firmware before 3.3b63) connects to the exposed on-chip debug interface and, through a specific interaction sequence, collects data from common resource locations on the chip, potentially impacting connected/subsequent systems. The high attack complexity and required user interaction mean this is not a drive-by attack. No public exploit code was identified at time of analysis.