Easy Io Neo
Monthly
Information disclosure in Johnson Controls Easy IO Neo versions before 3.3b63 allows an authenticated high-privileged attacker to read sensitive data from predictable common resource locations, but requires passive user interaction and yields low confidentiality impact per the independent assessment. This medium-severity flaw (CVSS 4.0 base 6.3, CWE-200) has no public exploit identified at time of analysis. Exploitation depends on the attacker already holding high-privilege access to the controller and on a victim performing passive user interaction, substantially limiting opportunistic exploitation.
Information disclosure in Johnson Controls Easy IO Neo versions before 3.3b63 allows an authenticated high-privileged attacker to read sensitive data from predictable common resource locations, but requires passive user interaction and yields low confidentiality impact per the independent assessment. This medium-severity flaw (CVSS 4.0 base 6.3, CWE-200) has no public exploit identified at time of analysis. Exploitation depends on the attacker already holding high-privilege access to the controller and on a victim performing passive user interaction, substantially limiting opportunistic exploitation.