CVE-2026-64893: Johnson Controls EasyIO Neo Controllers Leak Credentials in Cleartext — Detection and Remediation Guide

---
title: Cleartext HTTP Basic Authentication to Building Automation Controller
tid: 2f4c9a71-8d3e-4b6a-9c52-7e1a3f5d8b90
status: experimental
description: Detects HTTP Basic Auth Authorization headers directed at BAS/OT controller addresses, indicating cleartext credential transmission consistent with CVE-2026-64893 exposure on Johnson Controls EasyIO Neo controllers. Populate the ot_controller_ips filter with your EasyIO asset inventory.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-05
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1040
logsource:
  category: webserver
  product: zeek
  service: http
detection:
  selection:
    c-ip|contains:
      - '10.90.' # Replace with OT/BAS controller subnets
      - '192.168.200.' # Replace with OT/BAS controller subnets
    cs-method: 'GET'
    cs-uri|contains:
      - '/'
    Authorization|startswith: 'Basic '
  condition: selection
falsepositives:
  - Expected engineering workstation traffic prior to remediation - use this rule as an exposure discovery mechanism
level: medium
---
title: Packet Capture or Sniffing Tool Execution on OT-Adjacent Hosts
tid: 8b1e6d42-3a7f-4c9e-b5d1-6f2a8c4e9d73
status: experimental
description: Detects execution of common packet capture tooling on Windows hosts, which may indicate network sniffing used to harvest cleartext BAS credentials per CVE-2026-64893 attack chains. Scope to engineering workstations and OT DMZ jump hosts via your asset tagging.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-05
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.discovery
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\dumpcap.exe'
      - '\tshark.exe'
      - '\windump.exe'
      - '\rawcap.exe'
      - '\pktmon.exe'
  selection_cli:
    CommandLine|contains:
      - ' -i '
      - ' -w '
      - ' capture '
  selection_netsh:
    Image|endswith: '\netsh.exe'
    CommandLine|contains: 'trace start'
  condition: (selection_img and selection_cli) or selection_netsh
falsepositives:
  - Legitimate network troubleshooting by OT/network engineers - maintain an approved maintenance window list
level: high
---
title: ARP Spoofing or Unexpected Gateway ARP Change on OT Segment
tid: 4d7a2f18-9c6b-4e3d-a8f5-2b9e7c1d6a45
status: experimental
description: Detects gratuitous ARP replies and rapid ARP table churn indicative of ARP spoofing used to intercept cleartext controller traffic (CVE-2026-64893 attack prerequisite). Deploy via Zeek/Suricata ARP logging or switch-level dynamic ARP inspection syslog.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-05
  - https://attack.mitre.org/techniques/T1557/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.collection
  - attack.t1557.002
logsource:
  category: network
detection:
  selection:
    event_type:
      - 'arp'
      - 'dai_violation'
    message|contains:
      - 'gratuitous'
      - 'ARP Inspection'
      - 'duplicate address'
  condition: selection
falsepositives:
  - IP address reassignments during maintenance, failover events on redundant BAS head-ends
level: high

// Hunt 1: Cleartext HTTP (port 80) management traffic to BAS controller subnets
// Populate the subnet list with your EasyIO Neo asset inventory ranges
let OtSubnets = dynamic(["10.90.", "192.168.200."]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 80
| where DestinationIP startswith "10.90." or DestinationIP startswith "192.168.200."
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            ConnectionCount = count(), SourceHosts = dcount(SourceIP)
    by SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by ConnectionCount desc;

// Hunt 2: Packet capture tooling execution on engineering workstations / jump hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("dumpcap.exe", "tshark.exe", "windump.exe", "rawcap.exe", "pktmon.exe")
   or (FileName =~ "netsh.exe" and ProcessCommandLine has "trace start")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

// Hunt 3: New or unusual source IPs communicating with controller management ports
let KnownEngineers =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d) and TimeGenerated < ago(7d)
    | where RemotePort in (80, 443, 47808)
    | distinct LocalIP;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (80, 443, 47808)
| where LocalIP !in (KnownEngineers)
| summarize Connections = count(), Ports = make_set(RemotePort) by LocalIP, RemoteIP, DeviceName
| order by Connections desc;

-- Hunt for packet capture tools and capture artifacts on hosts with OT network access
-- Deploy against engineering workstations, BAS front-end servers, and jump hosts

LET capture_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(dumpcap|tshark|windump|rawcap|pktmon|wireshark)'
   OR CommandLine =~ '(?i)netsh.*trace start'

LET capture_files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/**/*.pcap', 'C:/Users/*/**/*.pcapng',
                 'C:/Users/*/**/*.cap', 'C:/ProgramData/**/*.pcapng',
                 'C:/Temp/**/*.pcap', 'C:/Temp/**/*.etl'])
WHERE Mtime > now() - 604800

LET ot_connections = SELECT Pid, Name, Path, Family, Type, Status,
       Laddr as LocalAddr, Lport as LocalPort,
       Raddr as RemoteAddr, Rport as RemotePort
FROM netstat()
WHERE RemotePort in (80, 443, 47808)
  AND Status =~ 'ESTAB'

SELECT * FROM capture_procs
UNION ALL
SELECT NULL, NULL, NULL, NULL, NULL, NULL FROM capture_files LIMIT 0

#!/bin/bash
# CVE-2026-64893 exposure checker - Johnson Controls EasyIO Neo EC/CW controllers
# Run from a secured management host. Never run active scans against OT segments
# without change-control approval and asset owner sign-off.

TARGETS_FILE="easyio_targets.txt"   # One controller IP per line, from your CMDB
REPORT="easyio_cleartext_report_$(date +%Y%m%d).csv"

echo "ip,http_open,https_open,basic_auth_cleartext,firmware_banner" > "$REPORT"

while read -r ip; do
  [ -z "$ip" ] && continue

  http_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "http://$ip/" 2>/dev/null)
  https_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "https://$ip/" 2>/dev/null)

  http_open="no"; https_open="no"; cleartext="no"
  [ "$http_code" != "000" ] && http_open="yes"
  [ "$https_code" != "000" ] && https_open="yes"

  # Detect HTTP Basic Auth over cleartext (401 + WWW-Authenticate: Basic on port 80)
  auth_hdr=$(curl -sk -I --max-time 5 "http://$ip/" 2>/dev/null | grep -i "WWW-Authenticate: Basic")
  [ -n "$auth_hdr" ] && cleartext="YES-EXPOSED"

  banner=$(curl -sk -I --max-time 5 "http://$ip/" 2>/dev/null | grep -i "Server:" | tr -d '\r' | tr ',' ';')

  echo "$ip,$http_open,$https_open,$cleartext,$banner" | tee -a "$REPORT"
done < "$TARGETS_FILE"

echo ""
echo "=== Hosts with cleartext Basic Auth exposed (CVE-2026-64893 risk) ==="
grep "YES-EXPOSED" "$REPORT" || echo "None found."
echo ""
echo "Next steps: restrict port 80 to controllers via ACL/firewall, verify firmware"
echo "version against ICSA-26-274-05, and confirm HTTPS-only management post-patch."