Easyio Neo
Monthly
Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO (all versions before 3.3b25) lets an attacker who has already achieved a man-in-the-middle position on the network path read data the controller exchanges without encryption. It is rated 7.3 under CVSS 4.0 and mapped to CWE-319, but exploitation is gated rather than trivial: the assessed vector (AV:N/AC:H/PR:L/UI:R, consistent with the CVSS 4.0 AC:H, AT:P, PR:L, UI:P values) requires channel control or interception, low privileges on the attacker side, and a victim-side transmission to occur. There is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate, context-dependent risk rather than an emergency, and impact is primarily confidentiality loss with limited integrity/availability effects.
Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO (all versions before 3.3b25) lets an attacker who has already achieved a man-in-the-middle position on the network path read data the controller exchanges without encryption. It is rated 7.3 under CVSS 4.0 and mapped to CWE-319, but exploitation is gated rather than trivial: the assessed vector (AV:N/AC:H/PR:L/UI:R, consistent with the CVSS 4.0 AC:H, AT:P, PR:L, UI:P values) requires channel control or interception, low privileges on the attacker side, and a victim-side transmission to occur. There is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate, context-dependent risk rather than an emergency, and impact is primarily confidentiality loss with limited integrity/availability effects.