The vulnerability is due to an improper neutralization of input used for LLM prompting in the EasyIO Neo IO Manager and Tools Installer, allowing an attacker to trigger search order hijacking. By supplying specially crafted prompts, an attacker can influence the order in which the application searches for resources, potentially causing it to load and execute malicious modules or data. This flaw can result in unauthorized code execution, privileging the attacker with the permissions of the installer service, thereby compromising confidentiality, integrity and availability of the system.

Johnson Controls EasyIO Neo IO Manager and Tools Installer, version 1.1.0.0, is affected. No other versions are listed as vulnerable. All instances running this version should be considered at risk until a patch is applied.

The CVSS score of 8.6 classifies the flaw as high severity. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the vulnerability is not yet listed in the CISA KEV catalog. The most probable attack vector is through exposed prompts that an attacker can send remotely or via an authenticated user interface. Until mitigations are applied, any authorized user with access to the prompting interface could potentially exploit the flaw.