EasyIO FS32 CVE-2026-71448

Exploitation requires an insecurely-initialized default resource on the EasyIO FS32 controller to be present (the condition inherent to this insecure-default-initialization flaw, affecting versions before 3.0b63). Limiting factors are significant: the attacker must be on the adjacent/local network (AV:A - not remotely internet-exploitable), must already possess high privileges (PR:H - authenticated/privileged access), must overcome high attack complexity (AC:H), and must meet a specific attack requirement (AT:P). These combined gates mean this is realistically exploitable only by an attacker who already has a privileged position on the building-automation network, not by an unauthenticated remote actor.

This is a MEDIUM-severity issue (CVSS 4.0 base 5.6) whose real-world risk is meaningfully constrained by its exploitation preconditions rather than its impact. The vector CVSS:4.0/AV:A/AC:H/AT:P/PR:H shows that an attacker needs adjacent-network access (not internet-routable), must already hold high privileges, must overcome high attack complexity, AND satisfy a specific attack requirement (AT:P) - four independent gates that collectively make opportunistic or mass exploitation unlikely. Offsetting that, the impact is severe once those gates are passed: VI:H/VA:H plus subsequent-system impacts SC:H/SI:H/SA:H indicate an attacker can compromise integrity and availability of both the device and downstream systems, which for a building-automation controller can mean manipulation of physical HVAC/control processes. The E:P maturity flag indicates a proof-of-concept exists, so publicly available exploit code likely exists, but there is NO CISA KEV listing and no EPSS value provided, so there is no evidence of widespread active exploitation - this reads as a credible but gated, likely-targeted risk rather than a wormable or internet-wide threat. One point to verify: the tag labels this 'Information Disclosure,' yet the CVSS confidentiality impact is only Low (VC:L) while integrity/availability are High - the tag appears inconsistent with the scored impact and the CWE-1188 authentication-abuse framing.

An attacker who has gained a foothold on the same adjacent network segment (e.g., an insider or a compromised device on the building network) and who already holds elevated access abuses an insecurely-initialized default resource/credential to bypass intended authentication controls on the EasyIO FS32 controller. Having defeated authentication, they tamper with control logic or configuration, affecting the integrity and availability of the controller and connected building systems. A proof-of-concept is indicated by the CVSS E:P maturity flag, though exploitation requires satisfying the high-complexity attack requirement.