Vulnerabilities Found in EasyIO FG Firmware
Researchers identified two security flaws in building automation hardware, though no public exploitation has been reported.
Updated on Oct. 6, 2026 in Cybersecurity
Live Poll
Do you trust that manufacturers are adequately securing critical infrastructure devices in your area?
Johnson Controls has disclosed two vulnerabilities affecting EasyIO FG firmware, tracked as CVE-2026-27872 and CVE-2026-27873. These flaws exist in version 2.0b52 and earlier and could allow unauthorized device access.
Why it matters
The discovery highlights risks inherent in industrial control systems that, if compromised, could grant attackers unauthorized access to building management hardware. Security experts emphasize that these vulnerabilities require high attack complexity and are not remotely exploitable.
The flaws affect EasyIO FG firmware version 2.0b52 and all prior iterations. While these vulnerabilities carry high attack complexity and are not remotely exploitable, they nonetheless grant unauthorized entry if triggered locally.
The players
Johnson Controls
An Irish multinational conglomerate that produces fire, HVAC, and security equipment for buildings.
CISA
The Cybersecurity and Infrastructure Security Agency is the U.S. federal authority responsible for protecting critical infrastructure.
University of Calgary
A Canadian public research university that conducted the analysis on the EasyIO hardware.
The details
The vulnerabilities were identified by researchers at the University of Calgary. Successful exploitation allows unauthorized access to the firmware, which governs building automation systems. Mitigation requires placing the hardware behind firewalls to isolate it from business networks and restricting remote entry to secure methods such as Virtual Private Networks (VPNs).
Timeline
- 2026-10-06
CISA issued the security advisory regarding the firmware flaws.
The Tech Race
This disclosure aligns with industry standards for securing industrial control systems against localized physical access threats. It follows the protocol established by CISA control systems security practices to provide defensive mitigation measures for industrial hardware vulnerabilities.
Administrators managing EasyIO FG devices should immediately isolate affected systems behind firewalls to prevent unauthorized access. All remote administrative connections must be funneled through secure Virtual Private Networks.
The takeaway
Security teams should prioritize segmenting industrial controllers from broader office networks to mitigate localized access risks. Monitor the CISA control systems security practices page for forthcoming vendor patches or updated firmware versions.
Further reading
For more on how organizations secure industrial networks, visit Cybersecurity.
More information
View the CISA control systems security practices for further defensive guidance.
Live Poll
Do you trust that manufacturers are adequately securing critical infrastructure devices in your area?
