EasyIO FS32 CVE-2026-71451

Exploitation requires an attacker positioned on the adjacent building-automation/OT network (AV:A - not internet-reachable by default) who already holds high-privileged authenticated access to the EasyIO FS32 controller (PR:H), and the attack carries elevated complexity with additional attack requirements (AC:H/AT:P) meaning specific runtime or configuration conditions must be present. Only EasyIO FS32 firmware before 3.0b63 is affected. These factors - privileged access, adjacent-only reachability, and high complexity - are the primary limiters and substantially constrain realistic exploitation to insiders or attackers who have already established an OT foothold. The exact feature/parameter carrying the injected command is not specified in the available description.

This is a CWE-78 OS command injection in the Johnson Controls EasyIO FS32 building-automation controller, scored 7.2 (High) using a CVSS 4.0 vector. The real-world risk is materially lower than the raw score suggests once the exploitability metrics are read together: AV:A limits the attack to an adjacent network (the building-automation/OT segment, not the open internet), AC:H plus AT:P indicate the attack is non-trivial and depends on specific conditions being met, and PR:H means the attacker must already hold high-privileged (authenticated) access to the device. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of privileged + adjacent + high-complexity access makes this an insider/post-compromise or deep-OT-foothold concern rather than a mass-exploitation threat. Note a signal tension worth verifying with the vendor: the published 4.0 vector rates direct (vulnerable-system) impact as only VC:L/VI:L but marks subsequent-system impact as SC:H/SI:H/SA:H and VA:H - unusual for a command-injection flaw, which typically grants full code execution on the host itself; confirm the intended impact scoping with Johnson Controls advisory JCI-PSA.

An attacker who has already obtained privileged, authenticated access to an EasyIO FS32 controller on the building-automation network submits crafted input to a field that is passed to an OS shell without sanitization, injecting arbitrary operating-system commands. Because exploitation requires adjacent-network position, high privileges, and meets the AC:H/AT:P complexity bar, it is most plausible as a post-compromise move by an insider or an attacker who has already pivoted onto the OT segment. No public exploit code was identified in the provided data.