Cameras and HVAC Controls on Your Business Network? New Warnings Show Why to Separate Them

Security cameras, thermostats, HVAC controllers, door locks and smart TVs are small computers. They connect to your network, and many of them get far fewer security updates than your PCs. On October 1, 2026, CISA published new advisories that are a good reminder of why that matters.

What was found

Building controls: Certain Johnson Controls EasyIO Neo controllers, used for HVAC and building automation in schools, churches, offices and municipal buildings, can send login credentials and session information unencrypted over the network. Someone positioned on that network could read them. The fix is a firmware update (EC controllers V3.3b64 or later, CW controllers V3.3b26 or later), which also turns off unencrypted web access by default.

Camera cloud: Meari provides the hardware, app and cloud service behind smart cameras, baby monitors and pet cameras sold under more than 300 brand names. Researchers found that a logged-in user could change the settings of devices they don’t own, or pull detailed information about any device, including credentials and owner details, just by knowing its ID. The advisory reports no fix from the vendor.

Neither issue has been reported as actively exploited. But both show the same pattern: you often don’t know who really makes your device or how well its cloud is protected.

The fix that works for every device: separate them

You can’t patch every camera brand’s cloud. You can make sure that if a device is compromised, it can’t reach anything important.

• Put cameras, HVAC, smart TVs and other “things” on their own network (a separate VLAN or guest network) with no access to your computers, server, backups or firewall settings.
• Never expose camera recorders or building-control admin pages directly to the internet. Use a VPN or the manufacturer’s secure remote app.
• Change default passwords and remove shared logins nobody uses anymore.
• Ask your HVAC contractor what controllers are installed and whether firmware is current. Ask specifically about EasyIO Neo.
• Buy business-grade cameras from brands with a record of security updates instead of bargain no-name models.

We install it the right way

Every security camera and alarm system we install goes on its own protected network, and we can do the same for existing cameras and building controls. Call us at 620-960-8711 or ask for a free network assessment.

Sources: CISA ICSA-26-274-04 (EasyIO Neo) · CISA ICSA-26-274-06 (Meari)