Affected Environment
Armatura One, Monta monta.app, ABB PCM600, Johnson Controls EasyIO Neo, Meari IoT Cloud OpenAPI, and CISA Malcolm deployments.
Threat Overview
Vulnerabilities enable arbitrary code execution, privilege escalation, authentication and authorization bypass, file overwrite, sensitive data exposure, and denial of service.
Exposure Timeline
Disclosed 2 October 2026. Armatura, Johnson Controls, and Malcolm have fixes; Monta and ABB offer mitigations; Meari lists none.
Attack Surface
Armatura ActiveMQ OpenWire listener, Monta WebSocket endpoints, PCM600 Scheduler Service, EasyIO web interface, Meari cloud API, and Malcolm web services.
Technical Root Cause
Deserialization, hard-coded credentials and keys, missing authentication and authorization, path traversal, cleartext transmission, and default or weak secrets.
Exploitation Pathway
Unauthenticated network attackers exploit ActiveMQ deserialization or Monta WebSockets; authenticated users abuse missing authorization, hard-coded credentials, or crafted archives.
Operational Impact
Host takeover via highest-privilege code execution, database access, charging station control, device manipulation, credential interception, and service disruption.
Strategic Impact
Armatura One scores CVSS 9.8 and Monta 9.4. Building, access control, and EV charging operators face physical and operational risk.
Required Mitigation
Apply vendor fixes: Armatura One 4.7.2 (USA 4.6.1), EasyIO EC V3.3b64, CW V3.3b26, Malcolm September 2026.
Incident Response Guidance
Monitor port 80 cleartext traffic and management access, rotate credentials, and apply vendor interim mitigations where patches are unavailable.
References
CISA ICS Advisories icsa-26-274-01 through 06 and icsa-26-254-01; Johnson Controls advisory JCI-PSA-2026-30.
Download the Full Report
.jpg)