---
id: CVE-2026-71450
title: >-
  Authentication bypass using an alternate path or channel vulnerability in
  Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication
  Bypass.


  This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62
  throug…
summary: >-
  Authentication bypass using an alternate path or channel vulnerability in
  Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication
  Bypass.


  This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62
  throug…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-288
vendor: Johnson Controls
product: EasyIO Neo EC and CW Edge Controller
affected:
  - easyio_neo_ec_and_cw_edge_controller >= EC 3.3b62 <= EC 3.3b63
  - easyio_neo_ec_and_cw_edge_controller >= CW 3.3b24 <= CW 3.3b25
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:49:00.217Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-71450'
references:
  - url: >-
      https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
tags:
  - cve.org
epss: 0.00283
epssPercentile: 0.20918
ingestedAt: '2026-11-05T19:30:42.883Z'
---

## Overview

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.

This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.

## Affected

- `easyio_neo_ec_and_cw_edge_controller >= EC 3.3b62 <= EC 3.3b63`
- `easyio_neo_ec_and_cw_edge_controller >= CW 3.3b24 <= CW 3.3b25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.