The vulnerability named "Authentication bypass using an alternate path or channel" allows an attacker to bypass authentication mechanisms on Johnson Controls EasyIO Neo EC and CW Edge Controller devices. It is classified as CWE-288, a weakness that permits credential‑free access. This flaw could enable an adversary to assume an authenticated identity without valid credentials, potentially accessing configuration and control functions that are normally restricted.

Affected vendors include Johnson Controls. The vulnerable products are EasyIO Neo EC and CW Edge Controller. The flaw impacts EasyIO Neo EC versions 3.3b62 through 3.3b63 and CW Edge Controller versions 3.3b24 through 3.3b25.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the exploitation probability is uncertain but potentially significant. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation yet. Based on the description, the attack vector is likely a network‑based interface that allows an attacker to route requests through an alternate authentication channel, but the precise exploitation method is not detailed in the advisory. Monitoring logs for anomalous authentication attempts and hardening the device’s authentication pathways are recommended.