EasyIO FS32 CVE-2026-71453

Exploitation requires (1) adjacent-network access to the EasyIO FS32 controller - typically the building-automation/OT network segment, not the public internet (AV:A); (2) a high-privilege, authenticated session on the device (PR:H); (3) satisfaction of a specific attack prerequisite condition (AT:P) and a high-complexity sequence (AC:H). The vulnerability lies in a feature that accepts an externally controlled file name or path (CWE-73), so the attacker must reach that specific path-handling function on an FS32 running a firmware version before 3.0b63. No end-user interaction is required (UI:N). The combination of adjacent-only reach, required elevated privileges, and high complexity are the primary factors limiting realistic exploitation; segmenting the OT network and restricting privileged access materially reduces risk.

This is a genuine-but-not-urgent issue whose real-world risk is substantially lower than a path-traversal CWE might suggest at first glance. The only quantitative severity signal provided is a CVSS 4.0 score of 5.6 (Medium) with vector CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N - meaning exploitation requires adjacent-network access (not internet-wide), high attack complexity, a specific attack prerequisite (AT:P), and high privileges (PR:H, i.e. authenticated with elevated rights). These combined constraints sharply reduce realistic attack likelihood. The CVSS 4.0 exploit-maturity component E:P indicates proof-of-concept exploit code is at the public/PoC stage, so publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score, SSVC decision, or NVD CVSS 3.1 vector supplied. There is a notable internal inconsistency in the supplied vector worth flagging: the vulnerable-system impacts are mixed (VC:L/VI:H/VA:H) yet every subsequent-system metric is set to High (SC:H/SI:H/SA:H), which for a file-path-traversal flaw gated behind PR:H on an embedded building-automation controller looks inflated - verify the subsequent-system scope claim with the vendor. Net: prioritize as a routine patch for exposed/OT-adjacent FS32 devices, not as an emergency; the adjacent-vector + high-privilege + high-complexity profile makes this far more plausible as a targeted insider/foothold-escalation step than as mass-exploited.

An attacker who already has adjacent-network access to a building-automation segment and holds high-privilege (authenticated/admin-level) access to an EasyIO FS32 controller supplies an externally controlled file name or path to a vulnerable feature, using directory-traversal sequences to read or write files outside the intended directory. Proof-of-concept exploit code is reported to exist (CVSS E:P), but the high attack complexity (AC:H) and required attack prerequisite (AT:P) mean the attack is not trivially reliable and is unlikely to be opportunistic.