CVE-2026-64892: Johnson Controls EasyIO Neo EC/CW Information Exposure — OT Defense and Remediation Guide

---
title: EasyIO Neo Controller Configuration or Backup Access by Non-Engineering Process
id: 9d2c6a1e-5f4b-4c91-a0e2-cve202664892001
status: experimental
description: Detects creation or access of files that look like EasyIO/Neo controller exports, backups, configs, or diagnostics by processes outside expected engineering tooling. Tune paths and approved tool list to the environment before broad deployment.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.collection
  - attack.t1005
  - attack.reconnaissance
  - attack.t1592
logsource:
  category: file_event
  product: windows
detection:
  selection_names:
    TargetFilename|contains:
      - 'easyio'
      - 'neo series'
      - 'neoseries'
      - 'controller backup'
      - 'controller config'
  selection_ext:
    TargetFilename|endswith:
      - '.bak'
      - '.backup'
      - '.cfg'
      - '.config'
      - '.zip'
      - '.7z'
      - '.csv'
      - '.log'
  filter_tools:
    Image|endswith:
      - '\approved_engineering_tool.exe'
      - '\approved_bas_client.exe'
  filter_users:
    User|contains:
      - 'BAS-ENG-'
      - 'OT-JUMP-'
  condition: selection_names and selection_ext and not filter_tools and not filter_users
falsepositives:
  - Legitimate controller backup jobs, commissioning activity, facilities exports, and vendor maintenance
  - Rename or path conventions that coincidentally include product terms
level: medium
---
title: Unexpected Host Communicating with EasyIO Neo Controller Naming Pattern
id: 7b1f8d44-2a6c-4e58-b317-cve202664892002
status: experimental
description: Flags Windows process network connections to hosts whose names indicate EasyIO EC/CW controllers where the initiating process is not an approved BAS or engineering application. Requires a controlled approved-image list and accurate controller naming to remain useful.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04
author: Security Arsenal
date: 2026/10/01
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: windows
detection:
  selection_dst:
    DestinationHostname|contains:
      - 'easyio'
      - 'neo-ec'
      - 'neo-cw'
      - 'bms-ec'
      - 'bms-cw'
  filter_process:
    Image|endswith:
      - '\approved_bas_server_service.exe'
      - '\approved_engineering_tool.exe'
      - '\scomagent.exe'
      - '\nessusd.exe'
  filter_src:
    SourceHostname|startswith:
      - 'OT-JUMP-'
      - 'BAS-APP-'
      - 'BAS-ENG-'
  condition: selection_dst and not filter_process and not filter_src
falsepositives:
  - Discovery scanners, asset inventory tools, printer/UPS naming collisions, and temporary vendor laptops
level: high

// Asset-aware hunt for access to EasyIO Neo EC/CW controllers from unapproved sources.
// Prerequisites: ingest firewall/NDR as CommonSecurityLog, controller/syslog as Syslog, and maintain watchlists.
let AffectedVersions = dynamic(['V3.3b63','V3.3b62','V3.3b25','V3.3b24']);
let ControllerTerms = dynamic(['easyio','neo series','neoseries','neo-ec','neo-cw','johnson controls']);
let ApprovedSources = toscalar(externaldata(SourceIP:string, Note:string)[h'https://contoso.invalid/approved_bms_sources.csv'] with(format='csv', ignoreFirstRecord=true) | project SourceIP);
let FW =
CommonSecurityLog
| where TimeGenerated > ago(7d)
| extend Dst = coalesce(DestinationHostName, DestinationIP)
| where Dst has_any (ControllerTerms) or DeviceProduct has_any (ControllerTerms) or AdditionalExtensions has_any (ControllerTerms)
| extend Source = coalesce(SourceHostName, SourceIP)
| where not(SourceIP in (ApprovedSources))
| project TimeGenerated, Vendor=DeviceVendor, Product=DeviceProduct, Source, SourceIP, DestinationIP, Dst, DestinationPort, Protocol, Message, AdditionalExtensions;
let SYS =
Syslog
| where TimeGenerated > ago(7d)
| where Computer has_any (ControllerTerms) or HostIP has_any (ControllerTerms) or SyslogMessage has_any (ControllerTerms) or SyslogMessage has_any (AffectedVersions)
| project TimeGenerated, Computer, HostIP, Facility, SeverityLevel, ProcessName, SyslogMessage;
union FW, SYS
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by tostring(Dst), tostring(Computer), tostring(SourceIP), tostring(DestinationPort)
| order by LastSeen desc;

-- Hunt Windows engineering/BAS-adjacent endpoints for controller-looking artifacts and unexpected network peers.
-- Scope to BMS engineering, jump hosts, and server VLANs; do not run indiscriminately across all fleets.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)easyio|neo.?series|controller.?backup|config.?export'
   OR Exe =~ '(?i)easyio|johnson.?controls|jci|neo'
   OR Name =~ '(?i)easyio|jci|bas|bms'

# Verify and harden Windows-based BMS jump hosts/engineering workstations.
# Run read-only first. Set -Apply to create the allowlist inbound firewall rule after change approval.
param(
  [switch]$Apply,
  [string[]]$ApprovedControllerSubnets = @('10.40.10.0/24','10.40.20.0/24'), # replace with real EasyIO subnets
  [string]$RuleName = 'BMS-EasyIO-Management-Allow-Approved-JumpHosts'
)

$ErrorActionPreference = 'SilentlyContinue'
Write-Host '[*] Local admin check and host context'
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name, ObjectClass, PrincipalSource

Write-Host '[*] Listening services and established connections to likely OT/BAS segments'
Get-NetTCPConnection -State Listen, Established |
  Where-Object { $_.RemoteAddress -match '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)' } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Sort-Object RemoteAddress,RemotePort

Write-Host '[*] Searching common data locations for EasyIO/controller export artifacts'
$roots = @($env:USERPROFILE + '\Documents', $env:USERPROFILE + '\Desktop', 'C:\ProgramData', 'D:\Backups')
Get-ChildItem -Path $roots -Recurse -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match '(?i)easyio|neo.?series|controller|bms|bas' -and $_.Extension -match '\.(bak|backup|cfg|config|zip|7z|csv|log)$' } |
  Select-Object FullName, Length, CreationTime, LastWriteTime

if ($Apply) {
  Write-Host '[*] Creating inbound firewall rule permitting controller management only from approved controller subnets'
  New-NetFirewallRule -DisplayName $RuleName -Direction Inbound -Action Allow -Protocol TCP -RemoteAddress $ApprovedControllerSubnets -Profile Domain,Private -Enabled True
}

Write-Host '[*] Review outbound egress. Controllers and jump hosts should not have broad internet access.'
Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True |
  Where-Object { $_.DisplayName -match '(?i)allow|any|internet' } |
  Select-Object DisplayName, Enabled, Profile, Action | Format-Table -AutoSize