Easy IO FG EUVD-2026-91041

Exploitation requires the attacker to already possess a low-privileged account and local access to the Easy IO FG controller (CVSS AV:L, PR:L), plus satisfaction of a specific attack precondition (AT:P) and a high-complexity sequence (AC:H) consistent with iterative brute-forcing of the privilege/authorization control. Limiting factors: no remote-unauthenticated path, no capability without prior local foothold, and high complexity make reliable exploitation difficult; affected deployments are those running Easy IO FG prior to 2.0b52. No end-user interaction is required (UI:N).

This is a medium-severity, operator-dependent privilege management flaw (CWE-269) in a niche building-automation controller, not a high-priority mass-exploitation risk. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:N) describes a LOCAL attack that requires existing low-level privileges (PR:L), high attack complexity (AC:H), and a specific attack precondition (AT:P) - all signals pointing to constrained, non-trivial exploitation rather than remote drive-by abuse. Signals partially conflict: the CVSS 4.0 vector carries E:P (Proof-of-Concept exploit maturity), yet the CISA SSVC framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing - so there is no evidence of active or automatable exploitation despite the POC-maturity hint. SSVC Technical Impact is rated 'partial,' consistent with a brute-force privilege-escalation path rather than full immediate compromise. No EPSS score was provided, so statistical exploitation probability cannot be weighed. Net: real but low-urgency; prioritize patching where the device is network-reachable by semi-trusted users, but it does not warrant emergency response.

An attacker who already holds a low-privileged local/authenticated account on an Easy IO FG controller repeatedly brute-forces a weakly protected privilege boundary to escalate to higher privileges on the device, gaining the ability to alter controller logic and availability. The CVSS 4.0 E:P maturity flag suggests proof-of-concept material may exist, but CISA SSVC reports no observed exploitation; high attack complexity (AC:H) and the required attack precondition (AT:P) make opportunistic abuse unlikely.