EasyIO FS32 EUVD-2026-91069

Exploitation requires network reachability to an EasyIO FS32 controller running a firmware version before 3.0b63, plus the ability to obtain the hard-coded cryptographic key - which is embedded identically in the product's firmware and recoverable once from any device or firmware image. No authentication or user interaction is indicated by the CVSS vector (PR:N/UI:N). Limiting factors: EasyIO FS32 is a building-automation/OT device typically deployed on segmented or non-internet-facing networks, so practical reach often depends on first gaining access to the building/management network; the impact is retrieval of embedded sensitive data rather than direct device takeover.

This is a genuinely high-priority flaw, though the headline signals warrant scrutiny. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and CWE-321 (Use of Hard-coded Cryptographic Key) is a reliable, repeatable weakness class - once the embedded key is extracted from one device or firmware image, it is identical across every deployed unit, which is why such flaws rank as high real-world risk despite being OT/building-automation products. The CVSS 4.0 vector carries E:P (Proof-of-Concept) exploit maturity, indicating demonstrated exploitability rather than mere theory, but there is NO CISA KEV listing and NO EPSS score in the provided data, so active, widespread exploitation is NOT established. The vendor-assigned impact of VC:H/VI:H/VA:H AND subsequent-system SC:H/SI:H/SA:H appears inflated for a weakness whose stated effect is only 'Retrieve Embedded Sensitive Data' - that description supports a strong confidentiality impact but does not clearly justify high integrity, availability, or a scope change to downstream systems; this discrepancy should be verified with Johnson Controls. Net: a real priority for anyone running EasyIO FS32 (a patch exists and should be applied), but the 9.3 score likely overstates integrity/availability impact relative to the described confidentiality disclosure.

An attacker extracts the hard-coded cryptographic key from EasyIO FS32 firmware (which is shared across all units) and uses it to decrypt or retrieve sensitive embedded data - such as credentials or configuration secrets - from any reachable device over the network. Because the CVSS vector indicates no authentication and low complexity, and the vector carries E:P proof-of-concept maturity, a working technique is demonstrable, though no public exploit is confirmed in the provided data.