Easyio Neo Ec And Cw Edge Controller
Monthly
Authentication bypass in Johnson Controls EasyIO Neo EC (firmware EC 3.3b62 through EC 3.3b63) and CW Edge Controller (CW 3.3b24 through CW 3.3b25) can let an attacker reach functionality through a channel that does not enforce the same authentication checks as the normal path, with high confidentiality, integrity and availability impact on the controller. The vendor rates it 8.7 under CVSS 4.0 but also scores high attack complexity, a required attack precondition, high privileges and active user interaction, prerequisites that sit awkwardly with the 'authentication bypass' label; the independent assessment instead models it as network-reachable with no privileges and no user interaction, so the true privilege and precondition requirements should be confirmed with Johnson Controls. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; priority is this_week.
Authentication bypass in Johnson Controls EasyIO Neo EC (firmware EC 3.3b62 through EC 3.3b63) and CW Edge Controller (CW 3.3b24 through CW 3.3b25) can let an attacker reach functionality through a channel that does not enforce the same authentication checks as the normal path, with high confidentiality, integrity and availability impact on the controller. The vendor rates it 8.7 under CVSS 4.0 but also scores high attack complexity, a required attack precondition, high privileges and active user interaction, prerequisites that sit awkwardly with the 'authentication bypass' label; the independent assessment instead models it as network-reachable with no privileges and no user interaction, so the true privilege and precondition requirements should be confirmed with Johnson Controls. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; priority is this_week.