EasyIO FS32 CVE-2026-27874

Requires adjacent-network reachability (AV:A) to an EasyIO FS32 controller running firmware before 3.0b63, plus the hard-coded/embedded credentials present in that firmware; the vendor vector's AT:P indicates an additional specific precondition must hold for the attack to succeed. Exploitation is LIMITED by: not being remotely internet-exploitable (adjacent segment access needed), the documented impact being confined to availability (no data disclosure or modification), and no scope change to downstream systems. Note the CWE-798 nature (hard-coded credentials) sits in tension with the vendor's PR:L rating - if credentials grant access without any legitimate privilege, effective privilege requirements may be lower than scored; verify against the full Johnson Controls advisory.

This is a moderate, context-dependent risk rather than an urgent, broadly-exploitable priority. The sole published CVSS is a vendor (Johnson Controls / 'jci') CVSS 4.0 base vector scoring 5.9 (Medium): AV:A (adjacent network, not internet-routable), AC:L, AT:P (a specific attack requirement/condition must be present), PR:L (some privilege), UI:N, with impact limited to availability of the vulnerable system (VA:H) and no confidentiality or integrity impact (VC:N/VI:N) and no scope change to other systems (SC/SI/SA:N). No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation is therefore no public exploit identified at time of analysis. The signals are internally consistent and point to a limited-blast-radius denial-of-service reachable only from an adjacent network segment, which is typical for a building-automation controller on an isolated OT/BAS network. One point of tension worth verifying: the weakness is CWE-798 (Use of Hard-coded Credentials), which normally implies an attacker gains access WITHOUT legitimate privileges (suggesting PR:N) and often yields confidentiality/integrity impact - yet the vendor vector sets PR:L and scopes impact to availability only. This PR and impact scoping should be confirmed against the full vendor advisory, as it materially affects whether the flaw is an unauthenticated foothold or merely an availability nuisance for an already-adjacent actor.

An attacker with access to the same building-automation / OT network segment as an EasyIO FS32 controller (e.g., via a compromised adjacent device or an insufficiently segmented management VLAN) authenticates using credentials hard-coded into the firmware. Because the documented impact is availability-only, the attacker then disrupts or crashes the controller's services, degrading HVAC/building-control functions. No public exploit code was identified, and the adjacent (AV:A) attack vector plus the AT:P requirement mean the attacker must already have a network foothold near the device.