EasyIO FS32 CVE-2026-71452

Exploitation requires (1) network reachability to the EasyIO FS32 controller on an adjacent/local network segment (AV:A - not routable internet exploitation by default), and (2) high-privilege authenticated access to the device (PR:H), i.e. administrative or operator-level credentials. Given those, the attacker injects OS commands via an input path the controller passes to a shell; no user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factors defenders can rely on are the required high-privilege authentication and the adjacent-network position - network segmentation of the OT/building-automation VLAN and strong credential hygiene materially reduce realistic exposure. The exact vulnerable feature/endpoint is not specified in the available data and should be confirmed from the Johnson Controls advisory.

This is a moderate-to-high severity OS command injection (CWE-78) in the Johnson Controls EasyIO FS32 building-automation controller, scored CVSS 7.2. The CVSS 4.0 vector is the most informative signal: AV:A (adjacent network, not internet-wide), AC:L (low complexity), and critically PR:H - exploitation requires high-privilege/authenticated access to the device, which substantially reduces the population of viable attackers. No UI is required (UI:N). The vector carries E:P (Proof-of-Concept exploit maturity), indicating proof-of-concept code exists, but there is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of widespread or active exploitation. The subsequent-system impacts (SC:H/SI:H/SA:H) reflect that command injection breaks out to the underlying device OS, which is the real driver of concern. Net: this is NOT an internet-facing, unauthenticated wormable flaw; it is a privilege-gated, adjacent-network OT exploitation path. For organizations running FS32 in sensitive building/OT networks it warrants prompt patching, but the PR:H and AV:A constraints make it a targeted-insider/compromised-network risk rather than a mass-exploitation priority. Note a tension worth verifying with the vendor: the input vector rates vulnerable-system confidentiality and integrity as LOW (VC:L/VI:L) yet availability and all subsequent-system impacts as HIGH - unusual for arbitrary OS command execution, which typically yields full C/I/A compromise.

An attacker with high-privilege (administrative/operator) access to an EasyIO FS32 controller, positioned on the same local/building network segment, submits input through an affected device function that is passed unsanitized to an OS shell, injecting arbitrary operating-system commands that execute on the controller. Proof-of-concept exploit maturity (CVSS E:P) is indicated, so working exploit technique is likely available. Because the device is an OT/building controller, successful execution can pivot to or disrupt connected building-automation functions.