EasyIO FG CVE-2026-27873

Exploitation requires access to an EasyIO FG controller running firmware before 2.0b52 and use of a vendor hard-coded credential (CWE-798) to perform password spraying against its authentication. The vendor CVSS vector limits realistic risk by asserting AV:L (local access to the device/interface), AC:H (high attack complexity), AT:P (a specific attack requirement must be met), and PR:L (the attacker already holds low-level privileges), with no user interaction needed. The decisive practical question defenders must resolve is whether the credentialed management interface is exposed on the network (BACnet/IP, web, or integration ports) - if so, the 'local' framing understates reachability; if the interface is segmented on an isolated OT network, exploitation is confined to attackers already inside that segment.

This is a moderate-priority, context-dependent issue rather than an internet-wide emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N) scores it 5.6 and models LOCAL attack vector, HIGH complexity, present attack requirements, and LOW privileges required - i.e. an authenticated, non-trivial attack - while assigning high integrity/availability impact (VI:H/VA:H) to the controller and its subsequent systems (SI:H/SA:H). Notably the vector contains E:P (Proof-of-Concept exploit maturity), which signals that POC-grade tradecraft may exist, though no public exploit URL is provided in the references and this is NOT confirmed active exploitation. There is NO CISA KEV listing and NO EPSS score in the input, so widespread opportunistic exploitation cannot be inferred. A key TENSION to verify with the vendor: the weakness is Use of Hard-coded Credentials (CWE-798) enabling 'Password Spraying,' which is normally a network-facing authentication technique, yet the CVSS vector asserts AV:L (local). These conflict - if the hard-coded credential is reachable over the network management interface, real-world risk is materially higher than the local, high-complexity vector implies. Treat the 5.6/local framing as the vendor's position but validate the actual reachability of the credentialed interface.

An attacker with low-level access to an EasyIO FG building-automation controller (or its management interface) leverages a hard-coded credential baked into firmware before 2.0b52 and sprays it to authenticate. Because the same static credential is reused across the product line, one recovered secret can unlock many devices, letting the attacker alter control logic or disrupt availability of HVAC/building systems. The CVSS E:P metric indicates proof-of-concept-level exploit maturity may exist, but no public exploit link is provided and active exploitation is not confirmed.