The flaw resides in the way Johnson Controls EasyIO Neo IOManager and Tools Installer stores sensitive configuration data directly in cleartext inside system memory, allowing an attacker to read that data. This vulnerability can lead to disclosure of embedded sensitive information that may be used for further attacks or unauthorized access. The issue is classified as a cleartext storage weakness (CWE‑316).

Affected versions include EasyIO Neo IOManager and Tools Installer 1.1.0.0. No other products or versions are listed as impacted.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is local memory access; an attacker who can access the process memory space, or gain local execution privileges, can retrieve the cleartext data. No specific remote exploitation path is disclosed in the available information.