Plan ahead Medium Patch available
Johnson Controls EasyIO FW has a confirmed vulnerability
Canadian Centre for Cyber SecurityJohnson Controls, EasyIO · building automation
What happened. The Canadian Centre for Cyber Security says Johnson Controls has confirmed a vulnerability in EasyIO FW, up to and including V3.0b25. It urges users to review the advisory links and apply updates.
Who is affected. Users of Johnson Controls EasyIO FW V3.0b25 and earlier, a building automation product.
What to do. Check whether you run EasyIO FW V3.0b25 or earlier, and apply the Johnson Controls update when available.
When to act. Plan ahead: Building operators: schedule the EasyIO firmware update; no exploitation is reported.
Editor's reading
Forasset ownervendor/integrator
- Purdue level
- L2
- L1
Why: EasyIO FW runs on building automation controllers, which sit at the control level (L1), with supervisory access at L2.
- Are you exposed?
Search your asset inventory for EasyIO FW and compare firmware versions with V3.0b25.
- If you cannot fix it yet
- Segment EasyIO devices behind a firewall and keep them off the internet.
- Restrict access to the devices to known engineering and management hosts.
- Watch for
- Connections to EasyIO devices from unknown hosts or from the IT network.
- Unexpected configuration or firmware changes on EasyIO controllers.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Canadian Centre for Cyber Security (opens cyber.gc.ca)
More on Johnson Controls Building automation