Vulnerabilities
Johnson Controls EasyIO FG Firmware Vulnerabilities CVE-2026-27872/27873: Hard-Coded Credentials Enable Full Device Compromise
Johnson Controls EasyIO FG firmware versions ≤2.0b52 are vulnerable to CVE-2026-27872 and CVE-2026-27873, allowing attackers to gain full unauthorized access via hard‑coded credentials and improper privilege management. The product is EOL/EOS with no patch available, so defenders must isolate the devices, enforce strict network segmentation, and migrate to supported models such as EasyIO Neo R1.
What Happened
Johnson Controls EasyIO FG firmware versions up to 2.0b52 contain two CVEs (CVE‑2026‑27872 and CVE‑2026‑27873) that allow an attacker to authenticate using hard‑coded credentials and then exploit improper privilege management to gain full device control.
Impact
Successful exploitation can lead to complete compromise of the device, potentially disrupting critical manufacturing, commercial facilities, government services, transportation, and energy operations. The product is EOL/EOS, so no patch will be released.
Mitigations
- Migrate to a supported model such as EasyIO Neo R1.
- Deploy the device only inside isolated BAS/OT networks.
- Ensure no direct Internet exposure.
- Enforce strict VLAN segmentation from enterprise IT networks.
- Restrict access to trusted engineering workstations.
- Block all remote login access.
Recommended Actions
Defenders should inventory all EasyIO FG units, verify firmware versions, and immediately isolate or replace them following the mitigation steps above.
Related vulnerabilities
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Hitachi Energy CoreTec OS Command Injection and Dirty Frag Vulnerabilities (CVE-2026-13162, CVE-2026-43284) – Immediate Mitigation Required
Hitachi Energy CoreTec devices are vulnerable to OS command injection (CVE-2026-13162) and Dirty Frag (CVE-2026-43284). The flaws affect versions 3.4.0 and earlier, as well as CoreTec5 5.0.0. Operators must upgrade firmware or apply patches immediately to prevent potential full system compromise.
Read briefing
FortiGate 6.4 Remote Code Execution Vulnerability (CVE-2026-1234)
Fortinet FortiGate 6.4.0-6.4.5 firmware contains a critical remote code execution flaw that can be triggered via a crafted HTTP header. The vulnerability is exploitable by unauthenticated attackers and could allow full device compromise. Defenders should immediately patch to 6.4.6 or later and block HTTP traffic from untrusted sources.
Read briefing
Grid Protection Alliance openPDC & openHistorian Vulnerabilities: CVE-2026-100730 and Related Issues
Grid Protection Alliance’s openPDC and openHistorian contain multiple critical flaws, including deserialization of untrusted data, missing authentication, SSRF, hard‑coded credentials, and unsafe reflection. Versions below 2.9.482 (openPDC) and 2.8.585 (openHistorian) are affected. Administrators should update to the latest releases and review authentication settings.
Read briefing