Operational Technology Security Roundup for October 12, 2026
Viakoo published its daily operational technology security briefing for October 12, 2026. The roundup highlights five verified advisories and vendor notices, including a CISA warning about EasyIO FG controller vulnerabilities that could permit full device access. It also notes that CISA reissued a Johnson Controls advisory, with mitigations and primary-source links included.
The October 12 briefing centers on a CISA notice for EasyIO FG controllers, tied to Johnson Controls advisory JCI-PSA-2026-12. The affected firmware is identified as versions up to 2.0b52, with CVE-2026-27872 and CVE-2026-27873. CISA attributes the issue to hard-coded credentials and improper privilege management, assigning a vendor CVSS v3 score of 7.7. Exploitation could grant full unauthorized device access, though attack complexity is high and remote exploitation is not indicated.
The advisory affects critical manufacturing, commercial facilities, government, transportation, and energy worldwide. CISA recommends reducing control-system exposure, avoiding internet access, using firewalls, isolating control networks from business networks, and securing remote access with an updated VPN. Teams should assess risk before changes, apply updates when available, and verify the exact affected-version boundary with Johnson Controls. The roundup also notes a separate Savannah lwIP SMTP client flaw.
Count words? First para: The(1) October2 12(3) briefing4 centers5 on6 a7 CISA8 notice9 for10 EasyIO11 FG12 controllers,13 tied14 to15 Johnson16 Controls17 advisory18 JCI-PSA-2026-12.19 The20 affected21 firmware22 is23 identified24 as25 versions26 up27 to28 2.0b52,29 with30 CVE-2026-27872 31 and32 CVE-2026-27873.33 CISA34 attributes35 the36 issue37 to38 hard-coded39 credentials40 and41 improper42 privilege43 management,44 assigning45 a46 vendor47 CVSS48 v3 49 score50 of51 7.7.52 Exploita
[paragraph] No extra. Need maybe blank line between paragraphs? Fine. Under 120 total for expanded. We have 110. Context 76. Good. Need ensure no copying source phrasing. We used some terms from source: hard-coded credentials, improper privilege management, CVSS v3, full unauthorized device access, critical manufacturing, commercial facilities, government, transportation, energy, control-system exposure, internet access, firewalls, control networks, VPN, risk before changes, updates, affected-version boundary. These are factual terms, but "never copying source phrasing" means avoid exact phrases? We can rephrase more. But some terms are standard. Need original wording. Let's adjust to avoid direct phrase copying. For example "hard-coded credentials" is a technical term, maybe okay. "improper privilege management" is exact. Could say "embedded login secrets and weak privilege controls" but that might be interpretation. Material says hard-coded credentials and improper privilege manage